resource "vault_mount" "secret" {
  path = module.config.vault.mount
  type = "kv"
  options = {
    version = "2"
  }
}

resource "vault_policy" "service" {
  for_each = module.config.services
  name     = "service-${each.key}"
  policy = jsonencode({
    path = {
      "${vault_mount.secret.path}/data/${each.key}/*" = {
        capabilities = ["read"]
      }
      "${module.config.vault.database_mount}/creds/${each.key}" = {
        capabilities = ["read"]
      }
    }
  })
}

resource "vault_auth_backend" "approle" {
  type = "approle"
}

resource "vault_approle_auth_backend_role" "service" {
  for_each       = module.config.services
  backend        = vault_auth_backend.approle.path
  role_name      = each.key
  token_policies = [vault_policy.service[each.key].name]
  token_ttl      = 3600
  token_max_ttl  = 14400
  secret_id_ttl  = 2592000
}

locals {
  kv = vault_mount.secret.path
  db = module.config.vault.database_mount
  ar = vault_auth_backend.approle.path

  manage = ["create", "read", "update", "delete"]
}

resource "vault_policy" "terraform" {
  name = "terraform"
  policy = jsonencode({
    path = {
      "auth/token/create" = { capabilities = ["update"] }

      "sys/mounts/${local.kv}"            = { capabilities = ["read"] }
      "sys/mounts/auth/${local.ar}"       = { capabilities = ["read"] }
      "sys/mounts/auth/${local.ar}/tune"  = { capabilities = ["read"] }
      "sys/policies/acl/service-*"        = { capabilities = local.manage }
      "sys/policies/acl/terraform"        = { capabilities = ["read", "update"] }
      "auth/${local.ar}/role/+"           = { capabilities = local.manage }
      "auth/${local.ar}/role/+/role-id"   = { capabilities = ["read"] }
      "auth/${local.ar}/role/+/secret-id" = { capabilities = ["update"] }

      "${local.kv}/data/+/s3"           = { capabilities = local.manage }
      "${local.kv}/data/+/postgres"     = { capabilities = local.manage }
      "${local.kv}/metadata/+/s3"       = { capabilities = ["read", "update", "delete"] }
      "${local.kv}/metadata/+/postgres" = { capabilities = ["read", "update", "delete"] }

      "sys/mounts/${local.db}"      = { capabilities = ["read"] }
      "sys/mounts/${local.db}/tune" = { capabilities = ["update"] }
      "${local.db}/config"          = { capabilities = ["list"] }
      "${local.db}/config/postgres" = { capabilities = ["read", "update"] }
      "${local.db}/roles/+"         = { capabilities = local.manage }

      "sys/storage/raft/snapshot" = { capabilities = ["read"] }
    }
  })
}