ephemeral "vault_kv_secret_v2" "quay_oidc" {
  mount = vault_mount.secret.path
  name  = "quay/oidc/zitadel"
}

resource "vault_kv_secret_v2" "quay_cluster_pull" {
  mount = vault_mount.secret.path
  name  = "quay/robots/cluster_pull"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    username = "PLACEHOLDER"
    token    = "PLACEHOLDER"
  })
}

resource "random_password" "versitygw_quay_secret_access_key" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "versitygw_quay_user" {
  mount = vault_mount.secret.path
  name  = "versitygw/users/quay"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    secretAccessKey = random_password.versitygw_quay_secret_access_key.result
  })

  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
}

resource "random_password" "quay_dragonfly_password" {
  length  = 48
  special = false
}

resource "vault_kv_secret_v2" "dragonfly_quay_acl" {
  mount = vault_mount.secret.path
  name  = "dragonfly/quay/acl"

  data_json_wo_version = 1
  data_json_wo = jsonencode({
    acl = "user default on >${random_password.quay_dragonfly_password.result} ~* &* +@all\n"
  })

  # Vault is source of truth after first write. Re-runs do not rotate the ACL.
}

resource "random_password" "quay_secret_key" {
  length  = 48
  special = false
}

resource "random_password" "quay_database_secret_key" {
  length  = 48
  special = false
}

resource "random_password" "quay_clair_psk" {
  length  = 44
  special = false
}

resource "vault_kv_secret_v2" "quay_secrets" {
  mount = vault_mount.secret.path
  name  = "quay/secrets"

  disable_read         = true
  data_json_wo_version = 1
  data_json_wo = jsonencode({
    oidc_client_id      = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_id"]
    oidc_client_secret  = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_secret"]
    redis_password      = random_password.quay_dragonfly_password.result
    s3_secret_key       = random_password.versitygw_quay_secret_access_key.result
    secret_key          = random_password.quay_secret_key.result
    database_secret_key = random_password.quay_database_secret_key.result
    clair_psk           = random_password.quay_clair_psk.result
    internal_ca_cert    = vault_pki_secret_backend_root_cert.root.certificate
  })
}