# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments)
# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time.
# Deployments consume them through the existing config_map_ref / secret_ref fields.
variable "env_files" {
  type = map(object({
    namespace = string
    path      = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env
    secret    = optional(bool, false)
    enabled   = optional(bool, true)
  }))
  default = {}
}

locals {
  env_files = { for name, f in var.env_files : name => f if f.enabled }

  # A duplicate key inside one file fails the plan on purpose.
  env_data = {
    for name, f in local.env_files : name => {
      for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) :
      split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1)
      if can(regex("^[A-Za-z_][^=\\s]*=", line))
    }
  }
}

resource "kubernetes_config_map_v1" "env_file" {
  for_each = { for name, f in local.env_files : name => f if !f.secret }
  metadata {
    name      = each.key
    namespace = each.value.namespace
    labels = {
      deployment_method = "Terraform"
    }
  }
  data = local.env_data[each.key]
}

resource "kubernetes_secret_v1" "env_file" {
  for_each = { for name, f in local.env_files : name => f if f.secret }
  metadata {
    name      = each.key
    namespace = each.value.namespace
    labels = {
      deployment_method = "Terraform"
    }
  }
  data = local.env_data[each.key]
}