##############################################################################
# Deployment Script: Managed PostgreSQL database (OVHcloud)
#
# Thin root calling the provisioner owned "dbaas" catalog module. The module
# provisions an OVHcloud Managed PostgreSQL cluster with one initial database
# and one application user. The user password is always generated server side
# by OVHcloud (it cannot be set to an arbitrary value) and is written by the
# module to Vault under the existing path contract, together with the
# connection attributes; only the Vault path is returned in the provisioning
# response. No secret material ever appears in this script or its outputs.
#
# No terraform/required_providers and no provider blocks are needed: the
# catalog module carries its own provider requirements, the cloud provider
# is configured from the runner environment and the Vault provider file is
# generated by the provisioner.
#
# Placeholders (all filled by the provisioner, never typed by the user):
#   - the module source placeholder resolves to the dbaas module of the
#     cloudProvider sent in the request headers
#   - 5a7905f1-d1ee-46dd-8dec-b276dc67dd31 is the scriptTriggerId of the request
#   - development-test is the value of the cloudAccount header
#   - 067d45e3-7bb3-4a6d-ac9c-6b8dc12eaba5 is the value of the requesterUniqueId header
##############################################################################

module "dbaas" {
  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//dbaas/ovh?ref=3.2.0-F-feature-simpl-31672.683.51d1d4ae"
  deployment_id       = "5a7905f1-d1ee-46dd-8dec-b276dc67dd31"
  cloud_account       = "development-test"
  requester_unique_id = "067d45e3-7bb3-4a6d-ac9c-6b8dc12eaba5"

  # OVHcloud macro region for the database nodes (for example SBG, GRA, DE),
  # not the datacenter suffixed region (SBG5) used for instances. The project
  # itself is not set here: the provider resolves it from the cloud account
  # configuration of the environment.
  region = "SBG"

  # Managed offer: PostgreSQL engine version and sizing. plan is essential,
  # business or production; flavor for example db1-4.
  engine_version = "16"
  plan           = "essential"
  flavor         = "db1-4"

  # Initial application database name. The application user name defaults to
  # simpl_app_user and becomes the last segment of the Vault credentials path.
  database_name = "simpl_app_db"

  # CIDR blocks allowed to reach the cluster on a public deployment. Without
  # this OVHcloud blocks all access. Open to the internet by default here,
  # restrict it to your own networks for anything beyond testing.
  allowed_ips = ["0.0.0.0/0"]

  # Optional private mode: attach the database nodes to an existing vRack
  # network of the same project and remove allowed_ips.
  # private_network_id = "<openstack network id>"
  # private_subnet_id  = "<subnet id>"
}

output "database_endpoint" {
  value = module.dbaas.database_endpoint
}

output "database_port" {
  value = module.dbaas.database_port
}

output "database_name" {
  value = module.dbaas.database_name
}

output "database_username" {
  value = module.dbaas.database_username
}

output "database_cluster_id" {
  value = module.dbaas.database_cluster_id
}

output "database_user_id" {
  value = module.dbaas.database_user_id
}

output "credentials_ref" {
  value = module.dbaas.credentials_ref
}