#!/usr/bin/env sh
# Read in-cluster infra-service ADMIN creds from the contour Vault and export them
# for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
# CI run steps so the exported vars live in the same shell as terragrunt.
#
# Paths are the platform bootstrap layout (same as the bootstrap cronjobs read):
#   secrets/postgresql/admin  postgres-password
#   secrets/kafka/bootstrap    interBrokerPassword
#   secrets/minio/admin        rootUser / rootPassword
#   secrets/rabbitmq/auth      username / password
set -eu
: "${VAULT_ADDR:?VAULT_ADDR is required}"
: "${VAULT_TOKEN:?VAULT_TOKEN is required}"

_kv() {
  curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" \
    | jq -r --arg k "$2" '.data.data[$k] // ""'
}

# Service endpoints default to the in-cluster svc DNS (consistent across contours);
# override via CI vars if a contour differs.
export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
export PG_ADMIN_PASSWORD="$(_kv postgresql/admin postgres-password)"

export KAFKA_BOOTSTRAP="${KAFKA_BOOTSTRAP:-kafka-kafka-contour.kafka.svc.cluster.local:9092}"
export KAFKA_ADMIN_USER="${KAFKA_ADMIN_USER:-inter_broker_user}"
export KAFKA_ADMIN_PASSWORD="$(_kv kafka/bootstrap interBrokerPassword)"
export KAFKA_SASL_MECHANISM="${KAFKA_SASL_MECHANISM:-plain}"

export MINIO_ENDPOINT="${MINIO_ENDPOINT:-minio.minio.svc.cluster.local:9000}"
export MINIO_ADMIN_USER="$(_kv minio/admin rootUser)"
export MINIO_ADMIN_PASSWORD="$(_kv minio/admin rootPassword)"

export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.cluster.local:15672}"
export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"

echo "infra admin creds loaded from Vault (${VAULT_ADDR})"