##############################################################################
# Deployment Script: Managed PostgreSQL database (OVHcloud)
#
# Thin root calling the provisioner owned "dbaas" catalog module. The module
# provisions an OVHcloud Managed PostgreSQL cluster with one initial database
# and one application user. The user password is always generated server side
# by OVHcloud (it cannot be set to an arbitrary value) and is written by the
# module to Vault under the existing path contract, together with the
# connection attributes; only the Vault path is returned in the provisioning
# response. No secret material ever appears in this script or its outputs.
#
# No terraform/required_providers and no provider blocks are needed: the
# catalog module carries its own provider requirements, the cloud provider
# is configured from the runner environment and the Vault provider file is
# generated by the provisioner.
#
# Placeholders (all filled by the provisioner, never typed by the user):
#   - the module source placeholder resolves to the dbaas module of the
#     cloudProvider sent in the request headers
#   - 4444 is the scriptTriggerId of the request
#   - development-test is the value of the cloudAccount header
#   - d3602a74-ea4a-42b9-b4eb-bee8611cfce1 is the value of the requesterUniqueId header
##############################################################################

module "dbaas" {
  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//dbaas/ovh?ref=3.2.0-F-feature-simpl-31669.676.1150352e"
  deployment_id       = "4444"
  cloud_account       = "development-test"
  requester_unique_id = "d3602a74-ea4a-42b9-b4eb-bee8611cfce1"

  # OVHcloud macro region for the database nodes (for example SBG, GRA, DE),
  # not the datacenter suffixed region (SBG5) used for instances. The project
  # itself is not set here: the provider resolves it from the cloud account
  # configuration of the environment.
  region = "SBG"

  # Managed offer: PostgreSQL engine version and sizing. plan is essential,
  # business or production; flavor for example db1-4.
  engine_version = "16"
  plan           = "essential"
  flavor         = "db1-4"

  # Initial application database name. The application user name defaults to
  # simpl_app_user and becomes the last segment of the Vault credentials path.
  database_name = "simpl_app_db"

  # Optional private mode: attach the database nodes to an existing vRack
  # network of the same project. Leave unset for a public deployment, in
  # which case allowed_ips restricts who can reach the cluster.
  # private_network_id = "<openstack network id>"
  # private_subnet_id  = "<subnet id>"
  allowed_ips        = ["203.0.113.0/24"]
}

output "database_endpoint" {
  value = module.dbaas.database_endpoint
}

output "database_port" {
  value = module.dbaas.database_port
}

output "database_name" {
  value = module.dbaas.database_name
}

output "database_username" {
  value = module.dbaas.database_username
}

output "database_cluster_id" {
  value = module.dbaas.database_cluster_id
}

output "database_user_id" {
  value = module.dbaas.database_user_id
}

output "credentials_ref" {
  value = module.dbaas.credentials_ref
}