terraform {
  required_version = "> 0.8.0"
  required_providers {
    bitwarden-secrets = {
      source  = "bitwarden/bitwarden-secrets"
      version = "0.5.4-pre"
    }
  }

}

provider "kubernetes" {
  config_path = "~/.kube/config"
}


provider "bitwarden-secrets" {
  api_url         = "https://bitwarden.tryton.geeraert.eu/api"
  identity_url    = "https://bitwarden.tryton.geeraert.eu/identity"
  access_token    = "0.9f4b7c5f-e6e7-4eff-929e-b474016a2b9c.bMRELajGGb7qMuXXvzgCCJdDfxfTCS:mFDT7tHSi43KJSnkwvTSYg=="
  organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
}

variable "kubernetes" {
  type = map(object({
    name  = optional(string)
    image = string
    pvc = optional(map(object({
      name                 = string
      pvc                  = optional(bool, false)
      config_map           = optional(bool, false)
      secret               = optional(bool, false)
      host_path            = optional(string)
      pvc_size             = optional(string)
      storage_class_name   = optional(string, "nfs-storage-intelligent")
      annotations_fileType = optional(string)
      existing_pvc         = optional(bool, false)
      mount_path           = string
      sub_path             = optional(string)
    })))
    environment = optional(map(object({
      name  = optional(string)
      value = optional(string)
      value_from = optional(object({
        secret_key_ref = object({
          name = string
          key  = optional(string, null)
        })
      }))
    })))
    replicas               = optional(number, 1)
    namespace              = optional(string)
    connected_namespace    = optional(string, "")
    command                = optional(list(string))
    service_port           = optional(list(number))
    service_type           = optional(string, "ClusterIP")
    service_name           = optional(string)
    domain_name            = optional(string)
    liveness_tcp_socket    = optional(number)
    liveness_http_get      = optional(string)
    liveness_http_get_path = optional(string)
    database               = optional(map(string))
    database_command       = optional(list(string))
    database_args          = optional(list(string))
    redis                  = optional(map(string))
    enabled                = optional(bool, true)
    secret_ref             = optional(list(string))
    config_map_ref         = optional(list(string))
    config_map_import      = optional(list(string))
    secret_import          = optional(list(string))
    extra_manifest         = optional(list(string))
    requirements           = optional(map(string))
    #    requirements = optional(map(string), {
    #      limits-cpu      = "800m"
    #      limits-memory   = "500Mi"
    #      requests-cpu    = "200m"
    #      requests-memory = "200Mi"
    #    })
    dns_nameservers       = optional(string)
    service_account_name  = optional(string)
    environment_variables = optional(map(string), { name = "value" })
    security_context      = optional(bool, false)
  }))

}

variable "database_backup_info" {
  type = map(object({
    image   = optional(string)
    command = optional(string)
  }))
  description = "based on DB engine, give the docker image and the command used to backup"
  default = {
    postgres = {
      image   = "alpine/psql"
      command = "pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
    }
    mysql = {
      image   = "mysql"
      command = "mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
    }
    sqlserver = {
      image   = "mcr.microsoft.com/mssql-tools"
      command = "/opt/mssql-tools/bin/sqlcmd -S $DB_HOST -U $DB_USERNAME -P $DB_PASSWORD -Q \"BACKUP DATABASE $DB_DATABASE_NAME TO DISK = '/backup/$DB_DATABASE_NAME-$(date +%Y%m%d).bak' WITH  COPY_ONLY, CHECKSUM,FORMAT, MEDIANAME = 'SQLServerBackups',NAME = 'Full Backup of SQLTestDB'\";exit"
    }
  }
}

locals {
  pvc_list = flatten([
    for key, value in var.kubernetes : [
      for index, pvc in value.pvc : {
        key                  = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
        index                = index
        pvc                  = pvc.pvc
        name                 = pvc.name
        pvc_size             = pvc.pvc_size
        mount_path           = pvc.mount_path
        storage_class_name   = pvc.storage_class_name
        annotations_fileType = pvc.annotations_fileType
        existing_pvc         = pvc.existing_pvc
        sub_path             = pvc.sub_path
        namespace            = coalesce(value.namespace, value.connected_namespace, key)
    }] if value.enabled == true && value.pvc != null
  ])

  # group duplicates instead of throwing an error
  pvc_map_grouped = {
    for p in local.pvc_list :
    p.key => p...
  }

  # keep only one PVC per key (take the first)
  pvc_map = {
    for k, list in local.pvc_map_grouped :
    k => list[0]
  }

  pvc_details = values(local.pvc_map)
}

locals {
  env_details = flatten([
    for key, value in var.kubernetes : [
      for index, env in value.environment_variables : {
        index = index
        name  = env
    }] if value.enabled == true && value.environment_variables != null
  ])
}


data "kubernetes_all_namespaces" "allns" {}

resource "kubernetes_namespace_v1" "automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
  metadata {
    annotations = {
      name = coalesce(each.value.namespace, each.key)
    }
    labels = {
      deployment_method = "Terraform"
    }
    name = coalesce(each.value.namespace, each.key)
  }
  depends_on = [data.kubernetes_all_namespaces.allns]
}

locals {
  kubernetes_manifests = flatten([
    for k, obj in var.kubernetes : [
      for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
      {
        key      = "${k}_${index}"
        name     = obj.name
        manifest = manifest
        enabled  = obj.enabled
      }
      if obj.enabled == true
    ]
  ])
}

resource "kubernetes_manifest" "manifest" {
  for_each = { for item in local.kubernetes_manifests : item.key => item }

  manifest = yamldecode(file(each.value.manifest))
  provider = kubernetes
}



resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
  metadata {
    namespace = coalesce(each.value.namespace, each.key)
    name      = "${each.value.name}-pvc"
    labels = {
      deployment_method = "Terraform"
    }
    annotations = {
      fileType = try(each.value.annotations_fileType, "file")
    }

  }

  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = each.value.storage_class_name
    resources {
      requests = {
        storage = each.value.pvc_size
      }
    }
  }
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${each.key}-db-pvc"
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = "nfs-storage-intelligent"
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${each.key}-db-backup"
    labels = {
      deployment_method = "Terraform"
    }
    annotations = {
    fileType = "Backup" }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = "nfs-storage-fastaccess"
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${each.key}-redis-pvc"
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = "nfs-storage-intelligent"
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_service_v1" "automatic_service" {
  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
  metadata {
    name      = "${each.key}-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
    annotations = each.value.service_type == "LoadBalancer" ? {
      "metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
    } : {}



  }
  spec {
    selector = {
      app = each.key
    }
    dynamic "port" {
      for_each = each.value.service_port != null ? each.value.service_port : []
      content {
        port        = port.value
        target_port = port.value
        name        = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")

      }
    }

    #    port {
    #      port        = each.value.service_port
    #      target_port = each.value.service_port
    #    }
    type = each.value.service_type


  }


}

resource "kubernetes_service_v1" "automatic_service_database" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
  metadata {
    name      = "${each.key}-db-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
      #username          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
    }
  }
  spec {
    selector = {
      app = "${each.key}-db"
    }
    port {
      port        = try(each.value.database.port, 5432)
      target_port = try(each.value.database.port, 5432)
    }

  }


}



resource "kubernetes_service_v1" "automatic_service_redis" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
  metadata {
    name      = "${each.key}-redis-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    selector = {
      app = "${each.key}-redis"
    }
    port {
      port        = 6379
      target_port = 6379
    }
  }
}



resource "kubernetes_deployment_v1" "automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = coalesce(each.value.name, each.key)

    labels = {
      app               = each.key
      deployment_method = "Terraform"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = each.key
      }
    }

    template {
      metadata {
        labels = {
          app               = each.key
          deployment_method = "Terraform"
        }
      }

      spec {
        container {
          image = each.value.image
          name  = coalesce(each.value.name, each.key)
          dynamic "port" {
            for_each = each.value.service_port != null ? each.value.service_port : []
            content {
              container_port = port.value
              #              name           = "${each.key}-${port.value}"
              name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
            }
          }


          dynamic "volume_mount" {
            for_each = each.value.pvc != null ? each.value.pvc : {}
            content {
              mount_path = volume_mount.value.mount_path
              name       = "${volume_mount.value.name}-pvc"
              sub_path   = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
            }
          }

          dynamic "volume_mount" {
            for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
            content {
              mount_path = "/backup"
              name       = "${each.key}-db-backup"
            }
          }

          dynamic "env_from" {
            for_each = each.value.secret_ref != null ? each.value.secret_ref : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }

            }
          }
          dynamic "env_from" {
            for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
            #for_each = each.value.database != null && each.value.enabled == true  ? ["${each.key}-db-terraform"] : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }
          dynamic "env_from" {
            for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }
          dynamic "env_from" {
            for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
            content {
              dynamic "config_map_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }

          command = each.value.command != null ? each.value.command : []


          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                    }
                  }
                }
              }

            }
          }
          dynamic "resources" {
            for_each = each.value.requirements != null ? [1] : []
            content {
              limits = {
                cpu    = each.value.requirements.limits-cpu
                memory = each.value.requirements.limits-memory
              }
              requests = {
                cpu    = each.value.requirements.requests-cpu
                memory = each.value.requirements.requests-memory
              }

            }
          }


          dynamic "security_context" {
            for_each = each.value.security_context == true ? [1] : []
            content {
              privileged = true
              #capabilities = {
              #  add : ["NET_ADMIN", "NET_RAW"]
              #}
            }
          }
          dynamic "liveness_probe" {
            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
            content {
              dynamic "tcp_socket" {
                for_each = each.value.liveness_tcp_socket != null ? [""] : []
                content {
                  port = each.value.liveness_tcp_socket
                }
              }

              dynamic "http_get" {
                for_each = each.value.liveness_http_get != null ? [""] : []
                content {
                  port = each.value.liveness_http_get
                  path = coalesce(each.value.liveness_http_get_path, "/")
                }
              }

              initial_delay_seconds = 3
              period_seconds        = 3
            }
          }
        }
        dynamic "dns_config" {
          for_each = each.value.dns_nameservers != null ? [1] : []
          content {
            nameservers = [each.value.dns_nameservers]
          }

        }
        service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null

        dynamic "volume" {
          for_each = each.value.pvc != null ? each.value.pvc : {}
          content {
            name = "${volume.value.name}-pvc"

            dynamic "persistent_volume_claim" {
              for_each = volume.value.pvc ? [1] : []
              content {
                claim_name = "${volume.value.name}-pvc"
              }
            }

            dynamic "config_map" {
              for_each = volume.value.config_map ? [1] : []
              content {
                name = volume.value.name
              }
            }

            dynamic "host_path" {
              for_each = volume.value.host_path != null ? [1] : []
              content {
                path = volume.value.host_path
              }
            }

            dynamic "secret" {
              for_each = volume.value.secret ? [1] : []
              content {
                secret_name = volume.value.name
              }
            }

          }
        }
        dynamic "volume" {
          for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
          content {
            name = "${each.key}-db-backup"

            persistent_volume_claim {
              claim_name = "${each.key}-db-backup"
            }
          }
        }

      }
    }
  }
  depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
}



resource "kubernetes_deployment_v1" "database-automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }


  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${coalesce(each.value.namespace, each.key)}-db"
    labels = {
      app               = each.key
      deployment_method = "Terraform"
      database          = "true"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = "${each.key}-db"
      }
    }

    template {
      metadata {
        labels = {
          app               = "${each.key}-db"
          deployment_method = "Terraform"
          database          = "true"
        }
      }

      spec {
        container {
          image = try(each.value.database.image, "docker.io/library/postgres:latest")
          name  = "${coalesce(each.value.name, each.key)}-db"
          port {

            container_port = 5432
            name           = "database-port"

          }

          volume_mount {
            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
            name       = "${each.key}-db-pvc"
          }

          dynamic "volume_mount" {
            for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
            content {
              mount_path = "/backup"
              name       = "${each.key}-db-backup"
            }
          }

          command = try([each.value.database.command], [])
          args    = each.value.database_args != null ? each.value.database_args : []

          dynamic "env_from" {
            for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }

          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                      #                     optional = true
                    }
                  }
                }
              }

            }
          }


        }


        volume {
          name = "${each.key}-db-pvc"
          persistent_volume_claim {
            claim_name = "${each.key}-db-pvc"
          }
        }

        dynamic "volume" {
          for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
          content {
            name = "${each.key}-db-backup"

            persistent_volume_claim {
              claim_name = "${each.key}-db-backup"
            }
          }
        }

      }
    }
  }
}


resource "kubernetes_cron_job_v1" "database-backup" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${coalesce(each.value.namespace, each.key)}-db-backup"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      app               = each.key
      deployment_method = "Terraform"
      database          = "true"
    }
  }
  spec {
    failed_jobs_history_limit     = 5
    schedule                      = "1 0 * * *"
    timezone                      = "Etc/UTC"
    successful_jobs_history_limit = 5
    job_template {
      metadata {}
      spec {
        backoff_limit              = 4
        ttl_seconds_after_finished = 100
        template {
          metadata {}
          spec {
            container {
              name    = "${coalesce(each.value.namespace, each.key)}-db-backup"
              image   = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
              command = ["/bin/sh", "-c"]
              args    = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
              env_from {
                secret_ref {
                  name = "${each.key}-db-terraform"
                }
              }
              volume_mount {
                mount_path = "/backup"
                name       = "${each.key}-db-backup"
              }
            }
            volume {
              name = "${each.key}-db-backup"
              persistent_volume_claim {
                claim_name = "${each.key}-db-backup"
              }
            }
          }
        }
      }
    }
  }
}


resource "kubernetes_deployment_v1" "redis-automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }


  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${coalesce(each.value.namespace, each.key)}-redis"
    labels = {
      app               = each.key
      deployment_method = "Terraform"
      redis             = "true"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = "${each.key}-redis"
      }
    }

    template {
      metadata {
        labels = {
          app               = "${each.key}-redis"
          deployment_method = "Terraform"
          redis             = "true"
        }
      }

      spec {
        container {
          image = try(each.value.redis.image, "docker.io/library/redis:7")
          name  = "${coalesce(each.value.name, each.key)}-redis"
          port {

            container_port = 6379
            name           = "redis-port"

          }

          volume_mount {
            mount_path = "/data"
            name       = "${each.key}-redis-pvc"
          }





          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                      #                    optional = true
                    }
                  }
                }
              }

            }
          }


          #          resources {
          #            limits = {
          #              cpu    = each.value.requirements.limits-cpu
          #              memory = each.value.requirements.limits-memory
          #            }
          #            requests = {
          #              cpu    = each.value.requirements.requests-cpu
          #              memory = each.value.requirements.requests-memory
          #            }
          #          }

          #          dynamic "liveness_probe" {
          #            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
          #           content {
          #              dynamic "tcp_socket" {
          #                for_each = each.value.liveness_tcp_socket != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_tcp_socket
          #                }
          #              }


          #              dynamic "http_get" {
          #                for_each = each.value.liveness_http_get != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_http_get
          #                  path = coalesce(each.value.liveness_http_get_path, "/")
          #                }
          #              }

          #              initial_delay_seconds = 3
          #              period_seconds        = 3
          #            }
          #          }
        }


        volume {
          name = "${each.key}-redis-pvc"
          persistent_volume_claim {
            claim_name = "${each.key}-redis-pvc"
          }
        }

      }
    }
  }
}

resource "kubernetes_config_map_v1" "automatic-configmap" {
  metadata {
    name      = "extra-sites-terraform"
    namespace = "reverse-proxy"
    annotations = {
      "reloader.stakater.com/match" : "true",
    }
  }

  data = {
    for key, value in var.kubernetes :
    "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
      name_site    = value.domain_name
      name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
    }) if value.domain_name != null && value.enabled == true
  }

}

data "bitwarden-secrets_secret" "configmap_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes : [
        for id in v.config_map_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.config_map_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_config_map_v1" "configmap_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}


data "bitwarden-secrets_secret" "secret_import" {
  for_each = {
    for pair in flatten([
      for k, v in var.kubernetes : [
        for id in v.secret_import : {
          map_key   = k
          secret_id = id
        }
      ] if v.secret_import != null && v.enabled == true
    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
  }
  id = each.value
}

resource "kubernetes_secret_v1" "secret_import" {
  for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
  metadata {
    name      = each.value.note
    namespace = split("__", each.value.key)[0]
  }
  data = yamldecode(each.value.value)
}


resource "kubernetes_secret_v1" "automatic-database-secret" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    DB_DATABASE_NAME    = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_DATABASE         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    POSTGRES_DB         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    MYSQL_DATABASE      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    PGDATABASE          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    DB_HOST             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    PGHOST              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    POSTGRES_HOST       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    DB_PASSWORD         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_PASSWORD      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    POSTGRES_PASSWORD   = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    PGPASSWORD          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    DB_USERNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    POSTGRES_USER       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    MYSQL_USER          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    PGUSER              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
    DATABASE_URL        = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
  }

}

resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-mapped-terraform"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
  }

  data = {
    "${try(each.value.database.map_name, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
    "${try(each.value.database.map_host, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
    "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
    "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
  }
}


resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__username"
  value      = try(each.value.database.username, each.key)
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
  for_each        = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key             = "${each.key}__db__password"
  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  length          = 32
  special         = true
  min_special     = 5
  avoid_ambiguous = true
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__host"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__port"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.port, 5432)
}

resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  key        = "${each.key}__db__name"
  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
  value      = try(each.value.database.name, each.key)
}