variable "device_names" {
  type    = set(string)
  default = []
}

# 1. Generate Private Keys for each device
resource "tls_private_key" "device_key" {
  for_each  = var.device_names
  algorithm = "RSA"
  rsa_bits  = 2048
}

# 1. Save the private key temporarily (needed for the openssl command)
resource "local_sensitive_file" "tmp_key" {
  for_each = var.device_names
  content  = tls_private_key.device_key[each.key].private_key_pem
  filename = "${path.module}/output/${each.key}.key"
}

# 2. Create Certificate Signing Requests (CSR)
resource "tls_cert_request" "device_csr" {
  for_each        = var.device_names
  private_key_pem = tls_private_key.device_key[each.key].private_key_pem

  subject {
    common_name  = each.key
    organization = "My Home Lab"
  }
}

# 3. Sign the Certificates using your existing CA
# Note: You need your CA cert and key available as files
resource "tls_locally_signed_cert" "device_cert" {
  for_each           = var.device_names
  cert_request_pem   = tls_cert_request.device_csr[each.key].cert_request_pem
  ca_private_key_pem = file("${path.module}/MyPrivateCA.key")
  ca_cert_pem        = file("${path.module}/MyPrivateCA.crt")

  validity_period_hours = 8760 # 1 year
  allowed_uses = [
    "client_auth",
    "digital_signature",
  ]
}

# 4. EXPORT: Generate the .p12 and the CRL automatically
# This runs every time a cert is added OR removed
resource "null_resource" "manage_certs" {
  triggers = {
    devices = join(",", var.device_names)
  }

  # When a cert is REMOVED from the list, Terraform marks it for destruction.
  # We use a 'destroy' provisioner to trigger the revocation in your CRL.
  provisioner "local-exec" {
    when    = destroy
    command = <<EOT
      openssl ca -config openssl.cnf -revoke ${self.id}.crt
      openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl
    EOT
  }

  # When a cert is ADDED, create the physical files and the .p12
  provisioner "local-exec" {
    command = "openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl"
  }
}

## 5. Output the .p12 files (Simplified example)
#resource "local_file" "cert_files" {
#  for_each = var.device_names
#  content  = tls_locally_signed_cert.device_cert[each.key].cert_pem
#  filename = "${path.module}/output/${each.key}.crt"
#}
# 2. Save the certificate temporarily
resource "local_file" "tmp_cert" {
  for_each = var.device_names
  content  = tls_locally_signed_cert.device_cert[each.key].cert_pem
  filename = "${path.module}/output/${each.key}.crt"
}

# 3. Create the .p12 bundle using local-exec
resource "null_resource" "create_p12" {
  for_each = var.device_names

  # This ensures the command runs if the cert or key changes
  triggers = {
    cert_id = tls_locally_signed_cert.device_cert[each.key].id
  }

  provisioner "local-exec" {
    command = <<EOT
      openssl pkcs12 -export \
      -out ${path.module}/output/${each.key}.p12 \
      -inkey ${path.module}/output/${each.key}.key \
      -in ${path.module}/output/${each.key}.crt \
      -certfile ${path.module}/MyPrivateCA.crt \
      -passout pass:YourSecretPassword123
    EOT
  }

  # Clean up the raw .key file afterward for security if you like
  # (Optional: Comment out if you want to keep the .key file)
  provisioner "local-exec" {
    command = "rm ${path.module}/output/${each.key}.key"
  }

  depends_on = [
    local_sensitive_file.tmp_key,
    local_file.tmp_cert
  ]
}