resource "minio_s3_bucket" "state_terraform_s3" {
  bucket = module.config.silo.state_bucket
  acl    = "private"

  lifecycle {
    prevent_destroy = true
  }
}

resource "minio_s3_bucket_versioning" "state_terraform_s3" {
  bucket = minio_s3_bucket.state_terraform_s3.bucket

  versioning_configuration {
    status = "Enabled"
  }
}

resource "minio_ilm_policy" "admin_policy" {
  bucket = minio_s3_bucket.state_terraform_s3.bucket

  rule {
    id     = "clean-rule-1"
    status = "Enabled"
    noncurrent_expiration {
      days = "90d"
    }
    expired_object_delete_marker = true
    abort_incomplete_multipart_upload {
      days_after_initiation = "6d"
    }
  }
}

resource "minio_s3_bucket" "backups" {
  bucket = module.config.silo.backup_bucket
  acl    = "private"
}

resource "minio_ilm_policy" "backups" {
  bucket = minio_s3_bucket.backups.bucket

  rule {
    id         = "expire-old-backups"
    status     = "Enabled"
    expiration = "30d"
  }
}

module "app_storage" {
  source   = "../modules/app-storage"
  for_each = local.services_with_buckets
  service  = { name = each.key, buckets = each.value.buckets }
}

resource "vault_kv_secret_v2" "s3" {
  for_each            = module.app_storage
  mount               = module.config.vault.mount
  name                = "${each.key}/s3"
  delete_all_versions = true
  data_json = jsonencode({
    endpoint   = module.config.silo.internal_endpoint
    buckets    = join(",", each.value.buckets)
    access_key = each.value.access_key
    secret_key = each.value.secret_key
  })
}