terraform-contour-mirror/modules/yc-database/main.tf

locals {
  databases_map = { for db in var.databases : "${db.cluster_id}:${db.database.name}:${db.user.name}" => db }
}

resource "random_password" "user_password" {
  for_each = local.databases_map

  length  = try(each.value.user.password_length, 32)
  special = try(each.value.user.password_special, false)
  upper   = true
  lower   = true
  numeric = true
}

data "yandex_mdb_postgresql_cluster" "existing" {
  for_each   = toset([for db in var.databases : db.cluster_id])
  cluster_id = each.value
}

resource "yandex_mdb_postgresql_user" "this" {
  for_each = local.databases_map

  cluster_id = each.value.cluster_id
  name       = each.value.user.name
  password   = random_password.user_password[each.key].result
  conn_limit = try(each.value.user.conn_limit, 10)

  # Permission на свою БД + дополнительные permissions
  # Yandex API требует явный permission даже для владельца
  dynamic "permission" {
    for_each = distinct(concat(
      [each.value.database.name],
      try(each.value.user.permissions, [])
    ))
    content {
      database_name = permission.value
    }
  }

  lifecycle {
    ignore_changes = [password]
  }
}

resource "yandex_mdb_postgresql_database" "this" {
  for_each = local.databases_map

  cluster_id = each.value.cluster_id
  name       = each.value.database.name
  owner      = yandex_mdb_postgresql_user.this[each.key].name
  lc_collate = try(each.value.database.lc_collate, "en_US.UTF-8")
  lc_type    = try(each.value.database.lc_type, "en_US.UTF-8")

  depends_on = [yandex_mdb_postgresql_user.this]

  dynamic "extension" {
    for_each = try(each.value.database.extensions, [])
    content {
      name = extension.value
    }
  }
}