terraform {
  required_version = "< 2.0.0"
  backend "pg" {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "internal_postgres"
  }

  required_providers {
    postgresql = {
      source  = "cyrilgdn/postgresql"
      version = "~> 1.26"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.8"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.0"
    }
  }
}

provider "vault" {}

ephemeral "vault_kv_secret_v2" "postgres_admin" {
  mount = var.vault_kv_mount
  name  = var.postgres_admin_vault_path
}

locals {
  postgres_admin_user     = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_user_key]
  postgres_admin_password = ephemeral.vault_kv_secret_v2.postgres_admin.data[var.postgres_admin_password_key]
}

provider "postgresql" {
  host     = var.postgres_host
  port     = 5432
  username = local.postgres_admin_user
  password = local.postgres_admin_password
  sslmode  = "require"
}

provider "random" {}

variable "postgres_host" {
  description = "LoadBalancer IP of the CNPG main-rw service."
  type        = string
}

variable "vault_kv_mount" {
  description = "Vault KV v2 mount containing PostgreSQL admin credentials."
  type        = string
  default     = "secret"
}

variable "postgres_admin_vault_path" {
  description = "Vault KV path containing the PostgreSQL admin credentials."
  type        = string
  default     = "postgres/admin"
}

variable "postgres_admin_user_key" {
  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin username."
  type        = string
  default     = "username"
}

variable "postgres_admin_password_key" {
  description = "Key in postgres_admin_vault_path containing the PostgreSQL admin password."
  type        = string
  default     = "password"
}