resource "random_password" "quay" {
  length  = 32
  special = false
}

resource "postgresql_role" "quay" {
  name     = "quay"
  login    = true
  password = random_password.quay.result

  lifecycle {
    ignore_changes = [password]
  }
}

resource "postgresql_database" "quay" {
  name  = "quay"
  owner = postgresql_role.quay.name
}

# Allows vault_db_admin to ALTER ROLE quay PASSWORD '...' for credential rotation.
resource "postgresql_grant_role" "vault_db_admin_quay" {
  role              = postgresql_role.vault_db_admin.name
  grant_role        = postgresql_role.quay.name
  with_admin_option = true
}

resource "postgresql_extension" "quay_pg_trgm" {
  name     = "pg_trgm"
  database = postgresql_database.quay.name
}

resource "random_password" "quay_clair" {
  length  = 32
  special = false
}

resource "postgresql_role" "quay_clair" {
  name     = "quay_clair"
  login    = true
  password = random_password.quay_clair.result

  lifecycle {
    ignore_changes = [password]
  }
}

resource "postgresql_database" "quay_clair" {
  name  = "quay_clair"
  owner = postgresql_role.quay_clair.name
}

# Allows vault_db_admin to ALTER ROLE quay_clair PASSWORD '...' for credential rotation.
resource "postgresql_grant_role" "vault_db_admin_quay_clair" {
  role              = postgresql_role.vault_db_admin.name
  grant_role        = postgresql_role.quay_clair.name
  with_admin_option = true
}