#!/usr/bin/env sh
# Read in-cluster infra-service ADMIN creds from the contour Vault and export them
# for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
# CI run steps so exports live in the same shell as terragrunt.
#   secrets/postgresql/admin  postgres-password
#   secrets/kafka/bootstrap    interBrokerPassword
#   secrets/minio/admin        rootUser / rootPassword
#   secrets/rabbitmq/auth      username / password
set -eu
: "${VAULT_ADDR:?VAULT_ADDR is required}"
: "${VAULT_TOKEN:?VAULT_TOKEN is required}"

_kv() {
  # $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error
  _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1") || true
  if [ "$_code" != "200" ]; then
    echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2
    printf ''
    return
  fi
  jq -r --arg k "$2" '.data.data[$k] // ""' /tmp/_kv.json
}

export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
export PG_ADMIN_PASSWORD="$(_kv postgresql/admin postgres-password)"

export KAFKA_BOOTSTRAP="${KAFKA_BOOTSTRAP:-kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094}"
export KAFKA_ADMIN_USER="${KAFKA_ADMIN_USER:-inter_broker_user}"
export KAFKA_ADMIN_PASSWORD="$(_kv kafka/bootstrap interBrokerPassword)"
export KAFKA_SASL_MECHANISM="${KAFKA_SASL_MECHANISM:-plain}"

# SKIP_MINIO_ADMIN=true on contours with no in-cluster MinIO (nothing to read, no
# buckets declared) — set as a CI var on that contour's repo.
if [ "${SKIP_MINIO_ADMIN:-false}" != "true" ]; then
  export MINIO_ENDPOINT="${MINIO_ENDPOINT:-minio.minio.svc.cluster.local:9000}"
  export MINIO_ADMIN_USER="$(_kv minio/admin rootUser)"
  export MINIO_ADMIN_PASSWORD="$(_kv minio/admin rootPassword)"
fi

export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.cluster.local:15672}"
export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"

# fail fast with the exact empties instead of leaving providers to give cryptic errors
_missing=""
_required="PG_ADMIN_PASSWORD KAFKA_ADMIN_PASSWORD RABBITMQ_ADMIN_USER RABBITMQ_ADMIN_PASSWORD"
[ "${SKIP_MINIO_ADMIN:-false}" != "true" ] && _required="$_required MINIO_ADMIN_USER MINIO_ADMIN_PASSWORD"
for _v in $_required; do
  eval "_val=\${$_v}"
  [ -n "$_val" ] || _missing="$_missing $_v"
done
if [ -n "$_missing" ]; then
  echo "load_admin_creds: EMPTY creds:${_missing} — VAULT_TOKEN cannot read the matching secrets/* paths" >&2
  exit 1
fi
echo "infra admin creds loaded from Vault (${VAULT_ADDR})"