// OVHcloud Managed PostgreSQL. The cloud provider credentials and the
// project (OVH_CLOUD_PROJECT_SERVICE) reach the provider from the runner
// environment, never from module inputs.

resource "ovh_cloud_project_database" "this" {
  service_name = var.project_id
  description  = "${var.name_prefix}-postgresql-${var.deployment_id}"
  engine       = "postgresql"
  version      = var.engine_version
  plan         = var.plan
  flavor       = var.flavor

  nodes {
    region     = var.region
    network_id = var.private_network_id
    subnet_id  = var.private_subnet_id
  }

  dynamic "ip_restrictions" {
    for_each = var.allowed_ips
    content {
      ip = ip_restrictions.value
    }
  }
}

resource "ovh_cloud_project_database_database" "this" {
  service_name = ovh_cloud_project_database.this.service_name
  engine       = ovh_cloud_project_database.this.engine
  cluster_id   = ovh_cloud_project_database.this.id
  name         = var.database_name
}

// The user password is ALWAYS generated server side by OVHcloud, it cannot
// be set to an arbitrary value: it is read from the computed .password
// attribute and delivered only through the Vault entry. password_reset is
// the provider's native rotation marker: any change to credentials_version
// makes OVHcloud regenerate the password in place, and the Vault entry is
// updated with the fresh credential in the same apply.
resource "ovh_cloud_project_database_postgresql_user" "this" {
  service_name   = ovh_cloud_project_database.this.service_name
  cluster_id     = ovh_cloud_project_database.this.id
  name           = var.username
  password_reset = var.credentials_version

  // Serialize operations against the cluster: OVH DBaaS processes one
  // operation at a time per cluster, and concurrent destroys (user +
  // database in parallel) intermittently fail with API 500s.
  depends_on = [ovh_cloud_project_database_database.this]
}