resource "minio_s3_bucket" "state_terraform_s3" {
  bucket = module.config.silo.state_bucket
  acl    = "private"

  lifecycle {
    prevent_destroy = true
  }
}

resource "minio_s3_bucket_versioning" "state_terraform_s3" {
  bucket = minio_s3_bucket.state_terraform_s3.bucket

  versioning_configuration {
    status = "Enabled"
  }
}

resource "minio_ilm_policy" "admin_policy" {
  bucket = minio_s3_bucket.state_terraform_s3.bucket

  rule {
    id     = "clean-rule-1"
    status = "Enabled"
    noncurrent_expiration {
      days = "90d"
    }
    expired_object_delete_marker = true
    abort_incomplete_multipart_upload {
      days_after_initiation = "6d"
    }
  }
}

module "bucket" {
  source          = "../modules/bucket"
  for_each        = module.config.buckets
  name            = each.key
  versioning      = each.value.versioning
  noncurrent_days = each.value.noncurrent_days
  expire_days     = each.value.expire_days
}

module "bucket_access" {
  source     = "../modules/bucket-access"
  for_each   = module.config.service_buckets
  name       = each.key
  read_write = [for bucket in each.value.read_write : module.bucket[bucket].name]
  read_only  = [for bucket in each.value.read_only : module.bucket[bucket].name]
}

resource "vault_kv_secret_v2" "s3" {
  for_each            = module.bucket_access
  mount               = module.config.vault.mount
  name                = "${each.key}/s3"
  delete_all_versions = true
  data_json = jsonencode({
    endpoint   = module.config.silo.internal_endpoint
    buckets    = join(",", each.value.buckets)
    access_key = each.value.access_key
    secret_key = each.value.secret_key
  })
}