terraform-contour-mirror/modules/vault-platform-secrets/main.tf

locals {
  regcred_input    = try(var.common.regcred, {})
  regcred_manual   = try(trimspace(local.regcred_input.dockerconfigjson), "")
  regcred_generate = try(local.regcred_input.generate, false)

  regcred_server         = try(local.regcred_input.server, "https://index.docker.io/v1/")
  regcred_username       = try(local.regcred_input.username, "")
  regcred_password_input = try(local.regcred_input.password, "")
  regcred_email          = try(local.regcred_input.email, "")
  regcred_password       = local.regcred_password_input != "" ? local.regcred_password_input : try(random_password.regcred_password[0].result, "")
  regcred_auth           = base64encode("${local.regcred_username}:${local.regcred_password}")
  regcred_generated = jsonencode({
    auths = {
      (local.regcred_server) = {
        username = local.regcred_username
        password = local.regcred_password
        email    = local.regcred_email
        auth     = local.regcred_auth
      }
    }
  })
  regcred_value = local.regcred_manual != "" ? local.regcred_manual : (
    local.regcred_generate ? local.regcred_generated : "CHANGE_ME"
  )

  smtp_input    = merge(try(var.common.smtp_secret, {}), try(var.common.smtp_auth, {}))
  smtp_manual   = try(trimspace(local.smtp_input.env_json), "")
  smtp_generate = try(local.smtp_input.generate, false)

  smtp_password_input = try(local.smtp_input.password, "")
  smtp_password       = local.smtp_password_input != "" ? local.smtp_password_input : try(random_password.smtp_password[0].result, "")
  smtp_generated_obj = {
    SMTP_HOST       = try(local.smtp_input.host, "smtp.placeholder.local")
    SMTP_PORT       = tostring(try(local.smtp_input.port, 587))
    SMTP_USERNAME   = try(local.smtp_input.username, "placeholder")
    SMTP_PASSWORD   = local.smtp_password
    SMTP_FROM_EMAIL = try(local.smtp_input.from_email, "noreply@example.local")
    SMTP_USE_TLS    = tostring(try(local.smtp_input.use_tls, true))
  }
  smtp_generated = jsonencode(local.smtp_generated_obj)
  smtp_value = local.smtp_manual != "" ? local.smtp_manual : (
    local.smtp_generate ? local.smtp_generated : "{}"
  )

  django_input    = try(var.common.django_auth, {})
  django_manual   = try(trimspace(local.django_input.token), "")
  django_generate = try(local.django_input.generate, false)
  django_extra    = try(local.django_input.extra, {})
  django_token = local.django_manual != "" ? local.django_manual : (
    local.django_generate ? try(random_password.django_token[0].result, "") : "CHANGE_ME"
  )
  django_username_manual = try(trimspace(local.django_input.username), "")
  django_password_manual = try(trimspace(local.django_input.password), "")
  django_token_decoded   = can(base64decode(local.django_token)) ? base64decode(local.django_token) : ""
  django_token_parts     = local.django_token_decoded != "" ? split(":", local.django_token_decoded) : []
  django_username = local.django_username_manual != "" ? local.django_username_manual : (
    length(local.django_token_parts) > 0 ? local.django_token_parts[0] : ""
  )
  django_password = local.django_password_manual != "" ? local.django_password_manual : (
    length(local.django_token_parts) > 1 ? join(":", slice(local.django_token_parts, 1, length(local.django_token_parts))) : ""
  )

  rsa_input          = try(var.common.rsa_keys, {})
  rsa_generate       = try(local.rsa_input.generate, false)
  rsa_bits           = try(local.rsa_input.bits, var.default_rsa_bits)
  rsa_public_manual  = try(trimspace(local.rsa_input.public_key), "")
  rsa_private_manual = try(trimspace(local.rsa_input.private_key), "")
  rsa_public = local.rsa_public_manual != "" ? local.rsa_public_manual : (
    local.rsa_generate ? try(tls_private_key.rsa_keys[0].public_key_pem, "") : "CHANGE_ME_PUBLIC"
  )
  rsa_private = local.rsa_private_manual != "" ? local.rsa_private_manual : (
    local.rsa_generate ? try(tls_private_key.rsa_keys[0].private_key_pem, "") : "CHANGE_ME_PRIVATE"
  )

  infra_defaults = {
    postgresql = {
      enabled = true
      admin = {
        enabled           = true
        generate          = false
        postgres_password = ""
      }
      s3 = {
        enabled    = false
        bucket     = ""
        endpoint   = "https://storage.yandexcloud.net"
        region     = "ru-central1"
        access_key = ""
        secret_key = ""
      }
      users = {
        enabled  = true
        generate = false
        values   = {}
      }
      apps = {}
      role = {
        enabled                    = true
        name                       = "postgresql"
        service_account_names      = ["postgresql"]
        service_account_namespaces = ["postgresql"]
        token_ttl                  = "24h"
      }
    }
    rabbitmq = {
      enabled = true
      auth = {
        enabled  = true
        generate = false
        username = ""
        password = ""
      }
      apps = {}
      role = {
        enabled                    = true
        name                       = "rabbitmq"
        service_account_names      = ["rabbitmq"]
        service_account_namespaces = ["rabbitmq"]
        token_ttl                  = "24h"
      }
    }
    minio = {
      enabled = true
      admin = {
        enabled       = true
        generate      = false
        root_user     = ""
        root_password = ""
      }
      apps = {}
      role = {
        enabled                    = true
        name                       = "minio"
        service_account_names      = ["minio-sa"]
        service_account_namespaces = ["minio"]
        token_ttl                  = "24h"
      }
    }
    kafka = {
      enabled = true
      bootstrap = {
        enabled               = true
        generate              = false
        cluster_id            = ""
        controller_password   = ""
        inter_broker_password = ""
      }
      apps = {}
      role = {
        enabled                    = true
        name                       = "kafka"
        service_account_names      = ["kafka-kafka-contour"]
        service_account_namespaces = ["kafka"]
        token_ttl                  = "24h"
      }
    }
    zitadel = {
      enabled = true
      postgresql = {
        enabled  = true
        generate = false
        password = ""
      }
      role = {
        enabled                    = true
        name                       = "zitadel"
        service_account_names      = ["zitadel-idp-contour"]
        service_account_namespaces = ["zitadel"]
        token_ttl                  = "24h"
      }
    }
    camunda = {
      enabled = true
      identity_components = {
        enabled  = true
        generate = false
        values   = {}
      }
      identity_firstuser = {
        enabled                     = true
        generate                    = false
        identity_firstuser_password = ""
      }
      keycloak_admin = {
        enabled        = true
        generate       = false
        admin_password = ""
      }
      postgresql = {
        enabled           = true
        generate          = false
        password          = ""
        postgres_password = ""
      }
      role = {
        enabled                    = true
        name                       = "camunda"
        service_account_names      = ["camunda-connectors", "camunda-identity", "camunda-operate", "camunda-optimize", "camunda-tasklist", "camunda-postgresql", "camunda-keycloak", "camunda-identity-postgresql"]
        service_account_namespaces = ["camunda"]
        token_ttl                  = "24h"
      }
    }
    keycloak = {
      enabled = false
      admin = {
        enabled  = true
        generate = false
        password = ""
      }
      postgresql = {
        enabled  = true
        generate = false
        host     = ""
        port     = ""
        user     = ""
        database = ""
        password = ""
      }
      role = {
        enabled                    = true
        name                       = "keycloak"
        service_account_names      = ["keycloak-keycloak-contour"]
        service_account_namespaces = ["keycloak"]
        token_ttl                  = "24h"
      }
    }
  }

  infra = {
    for name, cfg in local.infra_defaults :
    name => merge(cfg, try(var.infra[name], {}))
  }

  postgresql_cfg = local.infra.postgresql
  rabbitmq_cfg   = local.infra.rabbitmq
  minio_cfg      = local.infra.minio
  kafka_cfg      = local.infra.kafka
  zitadel_cfg    = local.infra.zitadel
  camunda_cfg    = local.infra.camunda
  keycloak_cfg   = local.infra.keycloak

  postgresql_admin_cfg            = merge(try(local.postgresql_cfg.admin, {}), try(var.infra.postgresql.admin, {}))
  postgresql_s3_cfg               = merge(try(local.postgresql_cfg.s3, {}), try(var.infra.postgresql.s3, {}))
  postgresql_users_cfg            = merge(try(local.postgresql_cfg.users, {}), try(var.infra.postgresql.users, {}))
  postgresql_apps_cfg             = try(local.postgresql_cfg.apps, {})
  rabbitmq_auth_cfg               = merge(try(local.rabbitmq_cfg.auth, {}), try(var.infra.rabbitmq.auth, {}))
  rabbitmq_apps_cfg               = try(local.rabbitmq_cfg.apps, {})
  minio_admin_cfg                 = merge(try(local.minio_cfg.admin, {}), try(var.infra.minio.admin, {}))
  minio_apps_cfg                  = try(local.minio_cfg.apps, {})
  kafka_bootstrap_cfg             = merge(try(local.kafka_cfg.bootstrap, {}), try(var.infra.kafka.bootstrap, {}))
  kafka_apps_cfg                  = try(local.kafka_cfg.apps, {})
  zitadel_pg_cfg                  = merge(try(local.zitadel_cfg.postgresql, {}), try(var.infra.zitadel.postgresql, {}))
  camunda_identity_components_cfg = merge(try(local.camunda_cfg.identity_components, {}), try(var.infra.camunda.identity_components, {}))
  camunda_identity_firstuser_cfg  = merge(try(local.camunda_cfg.identity_firstuser, {}), try(var.infra.camunda.identity_firstuser, {}))
  camunda_keycloak_cfg            = merge(try(local.camunda_cfg.keycloak_admin, {}), try(var.infra.camunda.keycloak_admin, {}))
  camunda_pg_cfg                  = merge(try(local.camunda_cfg.postgresql, {}), try(var.infra.camunda.postgresql, {}))
  keycloak_admin_cfg              = merge(try(local.keycloak_cfg.admin, {}), try(var.infra.keycloak.admin, {}))
  keycloak_pg_cfg                 = merge(try(local.keycloak_cfg.postgresql, {}), try(var.infra.keycloak.postgresql, {}))

  postgresql_admin_password = trimspace(try(local.postgresql_admin_cfg.postgres_password, "")) != "" ? trimspace(local.postgresql_admin_cfg.postgres_password) : (
    try(local.postgresql_admin_cfg.generate, false) ? try(random_password.postgresql_admin_password[0].result, "") : ""
  )
  postgresql_apps = {
    for app, cfg in local.postgresql_apps_cfg :
    app => merge(
      {
        enabled      = true
        generate     = false
        username     = ""
        password     = ""
        password_key = ""
      },
      cfg,
      {
        username     = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
        password_key = trimspace(try(cfg.password_key, "")) != "" ? trimspace(try(cfg.password_key, "")) : app
        password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
          try(cfg.generate, false) ? try(random_password.postgresql_app_password[app].result, "") : ""
        )
      }
    )
  }
  postgresql_app_user_values = {
    for app, cfg in local.postgresql_apps :
    try(cfg.password_key, app) => try(cfg.password, "")
    if try(cfg.enabled, true) && (
      try(local.postgresql_apps_cfg[app].generate, false) ||
      trimspace(try(local.postgresql_apps_cfg[app].password, "")) != ""
    )
  }
  postgresql_users_values = merge(
    try(local.postgresql_users_cfg.values, {}),
    local.postgresql_app_user_values,
  )
  postgresql_users_has_values = (
    length(keys(try(local.postgresql_users_cfg.values, {}))) > 0 ||
    length(keys({
      for app, cfg in local.postgresql_apps_cfg :
      app => cfg
      if try(cfg.enabled, true) && (
        try(cfg.generate, false) ||
        trimspace(try(cfg.password, "")) != ""
      )
    })) > 0
  )

  rabbitmq_password = trimspace(try(local.rabbitmq_auth_cfg.password, "")) != "" ? trimspace(local.rabbitmq_auth_cfg.password) : (
    try(local.rabbitmq_auth_cfg.generate, false) ? try(random_password.rabbitmq_password[0].result, "") : ""
  )
  rabbitmq_apps = {
    for app, cfg in local.rabbitmq_apps_cfg :
    app => merge(
      {
        enabled  = true
        generate = false
        username = ""
        password = ""
        vhost    = "/"
        permissions = {
          configure = ".*"
          write     = ".*"
          read      = ".*"
        }
        vhosts = []
      },
      cfg,
      {
        username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
        password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
          try(cfg.generate, false) ? try(random_password.rabbitmq_app_password[app].result, "") : ""
        )
        vhost = trimspace(try(cfg.vhost, "")) != "" ? trimspace(try(cfg.vhost, "")) : "/"
        permissions = merge(
          {
            configure = ".*"
            write     = ".*"
            read      = ".*"
          },
          try(cfg.permissions, {})
        )
        vhosts = length(try(cfg.vhosts, [])) > 0 ? [
          for vh in try(cfg.vhosts, []) : {
            name = trimspace(try(vh.name, "")) != "" ? trimspace(try(vh.name, "")) : (trimspace(try(cfg.vhost, "")) != "" ? trimspace(try(cfg.vhost, "")) : "/")
            permissions = merge(
              {
                configure = ".*"
                write     = ".*"
                read      = ".*"
              },
              try(vh.permissions, {})
            )
          }
        ] : []
      }
    )
  }

  minio_root_user = trimspace(try(local.minio_admin_cfg.root_user, "")) != "" ? trimspace(local.minio_admin_cfg.root_user) : (
    try(local.minio_admin_cfg.generate, false) ? try(random_password.minio_root_user[0].result, "") : ""
  )
  minio_root_password = trimspace(try(local.minio_admin_cfg.root_password, "")) != "" ? trimspace(local.minio_admin_cfg.root_password) : (
    try(local.minio_admin_cfg.generate, false) ? try(random_password.minio_root_password[0].result, "") : ""
  )
  minio_apps = {
    for app, cfg in local.minio_apps_cfg :
    app => merge(
      {
        enabled    = true
        generate   = false
        username   = ""
        password   = ""
        access_key = ""
        secret_key = ""
        policy     = "readwrite"
        buckets    = []
        client = {
          endpoint = "http://minio.minio.svc.cluster.local:9000"
          region   = "us-east-1"
        }
      },
      cfg,
      {
        username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
        password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
          try(cfg.generate, false) ? try(random_password.minio_app_password[app].result, "") : ""
        )
        access_key = trimspace(try(cfg.access_key, "")) != "" ? trimspace(try(cfg.access_key, "")) : (
          trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
        )
        secret_key = trimspace(try(cfg.secret_key, "")) != "" ? trimspace(try(cfg.secret_key, "")) : (
          trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
            try(cfg.generate, false) ? try(random_password.minio_app_password[app].result, "") : ""
          )
        )
        buckets = [
          for bucket in try(cfg.buckets, []) : (
            can(bucket.name) ? merge(
              {
                name       = ""
                policy     = "private"
                versioning = false
              },
              bucket
              ) : {
              name       = tostring(bucket)
              policy     = "private"
              versioning = false
            }
          )
          if trimspace(can(bucket.name) ? try(bucket.name, "") : tostring(bucket)) != ""
        ]
        client = merge(
          {
            endpoint = "http://minio.minio.svc.cluster.local:9000"
            region   = "us-east-1"
          },
          try(cfg.client, {})
        )
      }
    )
  }

  kafka_cluster_id = trimspace(try(local.kafka_bootstrap_cfg.cluster_id, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.cluster_id) : (
    try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_cluster_id[0].result, "") : ""
  )
  kafka_controller_password = trimspace(try(local.kafka_bootstrap_cfg.controller_password, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.controller_password) : (
    try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_controller_password[0].result, "") : ""
  )
  kafka_inter_broker_password = trimspace(try(local.kafka_bootstrap_cfg.inter_broker_password, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.inter_broker_password) : (
    try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_inter_broker_password[0].result, "") : ""
  )
  kafka_apps = {
    for app, cfg in local.kafka_apps_cfg :
    app => merge(
      {
        enabled  = true
        generate = false
        username = ""
        password = ""
        auth = {
          bootstrap_servers = "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
          security_protocol = "SASL_PLAINTEXT"
          sasl_mechanism    = "SCRAM-SHA-512"
        }
        topics = []
      },
      cfg,
      {
        username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
        password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
          try(cfg.generate, false) ? try(random_password.kafka_app_password[app].result, "") : ""
        )
        auth = merge(
          {
            bootstrap_servers = "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
            security_protocol = "SASL_PLAINTEXT"
            sasl_mechanism    = "SCRAM-SHA-512"
          },
          try(cfg.auth, {})
        )
        topics = [
          for topic in try(cfg.topics, []) : merge(
            {
              name               = ""
              partitions         = 3
              replication_factor = 1
              configs            = {}
            },
            topic
          )
          if trimspace(try(topic.name, "")) != ""
        ]
      }
    )
  }

  zitadel_pg_password = trimspace(try(local.zitadel_pg_cfg.password, "")) != "" ? trimspace(local.zitadel_pg_cfg.password) : (
    trimspace(try(local.postgresql_users_values["zitadel"], "")) != "" ? trimspace(try(local.postgresql_users_values["zitadel"], "")) : (
      try(local.zitadel_pg_cfg.generate, false) ? try(random_password.zitadel_pg_password[0].result, "") : ""
    )
  )

  camunda_keycloak_admin_password = trimspace(try(local.camunda_keycloak_cfg.admin_password, "")) != "" ? trimspace(local.camunda_keycloak_cfg.admin_password) : (
    try(local.camunda_keycloak_cfg.generate, false) ? try(random_password.camunda_keycloak_admin_password[0].result, "") : ""
  )

  camunda_identity_components = {
    "connectors-secret" = try(local.camunda_identity_components_cfg.values["connectors-secret"], "") != "" ? local.camunda_identity_components_cfg.values["connectors-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_connectors_secret[0].result, "") : "")
    "console-secret"    = try(local.camunda_identity_components_cfg.values["console-secret"], "") != "" ? local.camunda_identity_components_cfg.values["console-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_console_secret[0].result, "") : "")
    "keycloak-secret"   = try(local.camunda_identity_components_cfg.values["keycloak-secret"], "") != "" ? local.camunda_identity_components_cfg.values["keycloak-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_keycloak_secret[0].result, "") : "")
    "operate-secret"    = try(local.camunda_identity_components_cfg.values["operate-secret"], "") != "" ? local.camunda_identity_components_cfg.values["operate-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_operate_secret[0].result, "") : "")
    "optimize-secret"   = try(local.camunda_identity_components_cfg.values["optimize-secret"], "") != "" ? local.camunda_identity_components_cfg.values["optimize-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_optimize_secret[0].result, "") : "")
    "tasklist-secret"   = try(local.camunda_identity_components_cfg.values["tasklist-secret"], "") != "" ? local.camunda_identity_components_cfg.values["tasklist-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_tasklist_secret[0].result, "") : "")
    "zeebe-secret"      = try(local.camunda_identity_components_cfg.values["zeebe-secret"], "") != "" ? local.camunda_identity_components_cfg.values["zeebe-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_zeebe_secret[0].result, "") : "")
  }

  camunda_identity_firstuser_password = trimspace(try(local.camunda_identity_firstuser_cfg.identity_firstuser_password, "")) != "" ? trimspace(local.camunda_identity_firstuser_cfg.identity_firstuser_password) : (
    try(local.camunda_identity_firstuser_cfg.generate, false) ? try(random_password.camunda_identity_firstuser_password[0].result, "") : ""
  )

  camunda_pg_password = trimspace(try(local.camunda_pg_cfg.password, "")) != "" ? trimspace(local.camunda_pg_cfg.password) : (
    try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_password[0].result, "") : ""
  )
  camunda_pg_postgres_password = trimspace(try(local.camunda_pg_cfg.postgres_password, "")) != "" ? trimspace(local.camunda_pg_cfg.postgres_password) : (
    try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_postgres_password[0].result, "") : ""
  )

  keycloak_admin_password = trimspace(try(local.keycloak_admin_cfg.password, "")) != "" ? trimspace(local.keycloak_admin_cfg.password) : (
    try(local.keycloak_admin_cfg.generate, false) ? try(random_password.keycloak_admin_password[0].result, "") : ""
  )
  keycloak_pg_password = trimspace(try(local.keycloak_pg_cfg.password, "")) != "" ? trimspace(local.keycloak_pg_cfg.password) : (
    trimspace(try(local.postgresql_users_values["keycloak"], "")) != "" ? trimspace(try(local.postgresql_users_values["keycloak"], "")) : (
      try(local.keycloak_pg_cfg.generate, false) ? try(random_password.keycloak_pg_password[0].result, "") : ""
    )
  )

  policy_docs = {
    postgresql = <<-EOT
      path "${var.vault_kv_mount}/data/postgresql/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/postgresql/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/postgresql/users" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/postgresql/users" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/postgresql/s3" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/postgresql/s3" {
        capabilities = ["read"]
      }
    EOT
    rabbitmq   = <<-EOT
      path "${var.vault_kv_mount}/data/rabbitmq/auth" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/rabbitmq/auth" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/rabbitmq/apps/*" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/rabbitmq/apps" {
        capabilities = ["list", "read"]
      }

      path "${var.vault_kv_mount}/metadata/rabbitmq/apps/*" {
        capabilities = ["read"]
      }
    EOT
    minio      = <<-EOT
      path "${var.vault_kv_mount}/data/minio/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/minio/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/minio/apps/*" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/minio/apps" {
        capabilities = ["list", "read"]
      }

      path "${var.vault_kv_mount}/metadata/minio/apps/*" {
        capabilities = ["read"]
      }
    EOT
    kafka      = <<-EOT
      path "${var.vault_kv_mount}/data/kafka/bootstrap" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/kafka/bootstrap" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/kafka/apps/*" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/kafka/apps" {
        capabilities = ["list", "read"]
      }

      path "${var.vault_kv_mount}/metadata/kafka/apps/*" {
        capabilities = ["read"]
      }
    EOT
    zitadel    = <<-EOT
      path "${var.vault_kv_mount}/data/zitadel/postgresql" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/zitadel/postgresql" {
        capabilities = ["read"]
      }
    EOT
    camunda    = <<-EOT
      path "${var.vault_kv_mount}/data/camunda/identity-components" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/camunda/identity-components" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/camunda/identity-firstuser" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/camunda/identity-firstuser" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/camunda/keycloak-admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/camunda/keycloak-admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/camunda/postgresql" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/camunda/postgresql" {
        capabilities = ["read"]
      }
    EOT
    keycloak   = <<-EOT
      path "${var.vault_kv_mount}/data/keycloak/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/keycloak/admin" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/data/keycloak/postgresql" {
        capabilities = ["read"]
      }

      path "${var.vault_kv_mount}/metadata/keycloak/postgresql" {
        capabilities = ["read"]
      }
    EOT
  }

  policy_enabled = {
    postgresql = try(local.postgresql_cfg.enabled, true)
    rabbitmq   = try(local.rabbitmq_cfg.enabled, true)
    minio      = try(local.minio_cfg.enabled, true)
    kafka      = try(local.kafka_cfg.enabled, true)
    zitadel    = try(local.zitadel_cfg.enabled, true)
    camunda    = try(local.camunda_cfg.enabled, true)
    keycloak   = try(local.keycloak_cfg.enabled, true)
  }

  role_cfgs = {
    postgresql = merge(try(local.postgresql_cfg.role, {}), try(var.infra.postgresql.role, {}))
    rabbitmq   = merge(try(local.rabbitmq_cfg.role, {}), try(var.infra.rabbitmq.role, {}))
    minio      = merge(try(local.minio_cfg.role, {}), try(var.infra.minio.role, {}))
    kafka      = merge(try(local.kafka_cfg.role, {}), try(var.infra.kafka.role, {}))
    zitadel    = merge(try(local.zitadel_cfg.role, {}), try(var.infra.zitadel.role, {}))
    camunda    = merge(try(local.camunda_cfg.role, {}), try(var.infra.camunda.role, {}))
    keycloak   = merge(try(local.keycloak_cfg.role, {}), try(var.infra.keycloak.role, {}))
  }

  app_cfgs = {
    for app, cfg in try(var.applications, {}) :
    app => merge(
      {
        enabled                    = true
        policy_name                = app
        role_name                  = app
        service_account_names      = [app]
        service_account_namespaces = [app]
        token_ttl                  = "24h"
        read_paths                 = []
        secret_path                = ""
        secret_data                = {}
      },
      cfg,
      {
        secret_path = trimspace(try(cfg.secret_path, ""))
        # Секретные значения обёрнуты под applications.<app>.data.secret_data
        # (см. .sops.yaml encrypted_regex) - secret_path не секрет, это путь.
        secret_data = try(cfg.data.secret_data, {})
        read_paths = distinct(compact(concat(
          [for path in try(cfg.read_paths, []) : trimspace(path)],
          trimspace(try(cfg.secret_path, "")) != "" ? [trimspace(try(cfg.secret_path, ""))] : []
        )))
      }
    )
    if try(cfg.enabled, true)
  }

  app_policy_docs = {
    for app, cfg in local.app_cfgs :
    app => trimspace(join("\n\n", [
      for path in cfg.read_paths : <<-EOT
        path "${var.vault_kv_mount}/data/${path}" {
          capabilities = ["read"]
        }

        path "${var.vault_kv_mount}/metadata/${path}" {
          capabilities = ["read"]
        }
      EOT
    ]))
  }
}

resource "random_password" "regcred_password" {
  count = var.create_regcred && local.regcred_generate && local.regcred_password_input == "" ? 1 : 0

  length  = 40
  special = false
}

resource "random_password" "smtp_password" {
  count = var.create_smtp_auth && local.smtp_generate && local.smtp_password_input == "" ? 1 : 0

  length  = 40
  special = false
}

resource "random_password" "django_token" {
  count = var.create_django_auth && local.django_generate && local.django_manual == "" ? 1 : 0

  length  = 40
  special = false
}

resource "tls_private_key" "rsa_keys" {
  count = var.create_rsa_keys && local.rsa_generate && local.rsa_public_manual == "" && local.rsa_private_manual == "" ? 1 : 0

  algorithm = "RSA"
  rsa_bits  = local.rsa_bits
}

resource "random_password" "postgresql_admin_password" {
  count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_admin_cfg.enabled, true) && try(local.postgresql_admin_cfg.generate, false) && trimspace(try(local.postgresql_admin_cfg.postgres_password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "postgresql_app_password" {
  for_each = {
    for app, cfg in local.postgresql_apps_cfg :
    app => cfg if var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
  }

  length  = 32
  special = false
}

resource "random_password" "rabbitmq_password" {
  count = var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.generate, false) && trimspace(try(local.rabbitmq_auth_cfg.password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "rabbitmq_app_password" {
  for_each = {
    for app, cfg in local.rabbitmq_apps_cfg :
    app => cfg if var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
  }

  length  = 32
  special = false
}

resource "random_password" "minio_root_user" {
  count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) && try(local.minio_admin_cfg.generate, false) && trimspace(try(local.minio_admin_cfg.root_user, "")) == "" ? 1 : 0

  length  = 20
  special = false
}

resource "random_password" "minio_root_password" {
  count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) && try(local.minio_admin_cfg.generate, false) && trimspace(try(local.minio_admin_cfg.root_password, "")) == "" ? 1 : 0

  length  = 40
  special = false
}

resource "random_password" "minio_app_password" {
  for_each = {
    for app, cfg in local.minio_apps_cfg :
    app => cfg if var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
  }

  length  = 32
  special = false
}

resource "random_password" "kafka_cluster_id" {
  count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.cluster_id, "")) == "" ? 1 : 0

  length  = 22
  special = false
}

resource "random_password" "kafka_controller_password" {
  count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.controller_password, "")) == "" ? 1 : 0

  length  = 20
  special = false
}

resource "random_password" "kafka_inter_broker_password" {
  count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.inter_broker_password, "")) == "" ? 1 : 0

  length  = 20
  special = false
}

resource "random_password" "kafka_app_password" {
  for_each = {
    for app, cfg in local.kafka_apps_cfg :
    app => cfg if var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
  }

  length  = 32
  special = false
}

resource "random_password" "zitadel_pg_password" {
  count = var.create_infra_secrets && try(local.zitadel_cfg.enabled, true) && try(local.zitadel_pg_cfg.enabled, true) && try(local.zitadel_pg_cfg.generate, false) && trimspace(try(local.zitadel_pg_cfg.password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "camunda_keycloak_admin_password" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_keycloak_cfg.enabled, true) && try(local.camunda_keycloak_cfg.generate, false) && trimspace(try(local.camunda_keycloak_cfg.admin_password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "camunda_connectors_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["connectors-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_console_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["console-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_keycloak_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["keycloak-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_operate_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["operate-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_optimize_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["optimize-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_tasklist_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["tasklist-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_zeebe_secret" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["zeebe-secret"], "") == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_identity_firstuser_password" {
  count   = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.generate, false) && trimspace(try(local.camunda_identity_firstuser_cfg.identity_firstuser_password, "")) == "" ? 1 : 0
  length  = 32
  special = false
}

resource "random_password" "camunda_pg_password" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "camunda_pg_postgres_password" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.postgres_password, "")) == "" ? 1 : 0

  length  = 32
  special = false
}

resource "random_password" "keycloak_admin_password" {
  count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) && try(local.keycloak_admin_cfg.generate, false) && trimspace(try(local.keycloak_admin_cfg.password, "")) == "" ? 1 : 0

  length  = 20
  special = false
}

resource "random_password" "keycloak_pg_password" {
  count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_pg_cfg.enabled, true) && trimspace(try(local.keycloak_pg_cfg.password, "")) == "" && try(local.keycloak_pg_cfg.generate, false) ? 1 : 0

  length  = 32
  special = false
}

resource "vault_kv_secret_v2" "common_regcred" {
  count = var.create_regcred ? 1 : 0

  mount = var.vault_kv_mount
  name  = "${var.path_prefix}/common/regcred"

  data_json = jsonencode({
    type                = "kubernetes.io/dockerconfigjson"
    ".dockerconfigjson" = local.regcred_value
  })
}

resource "vault_kv_secret_v2" "common_smtp_auth" {
  count = var.create_smtp_auth ? 1 : 0

  mount = var.vault_kv_mount
  name  = "${var.path_prefix}/common/smtp_auth"

  data_json = jsonencode({
    "env.json" = local.smtp_value
  })
}

resource "vault_kv_secret_v2" "common_django_auth" {
  count = var.create_django_auth ? 1 : 0

  mount = var.vault_kv_mount
  name  = "${var.path_prefix}/common/django_auth"

  data_json = jsonencode(merge(
    {
      "django-auth.json" = jsonencode({
        token = local.django_token
      })
      key      = local.django_token
      username = local.django_username
      password = local.django_password
    },
    local.django_extra
  ))
}

resource "vault_kv_secret_v2" "common_rsa_keys" {
  count = var.create_rsa_keys ? 1 : 0

  mount = var.vault_kv_mount
  name  = "${var.path_prefix}/common/rsa_keys"

  data_json = jsonencode({
    public_key  = local.rsa_public
    private_key = local.rsa_private
  })
}

resource "vault_kv_secret_v2" "postgresql_admin" {
  count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_admin_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "postgresql/admin"

  data_json = jsonencode({
    "postgres-password" = local.postgresql_admin_password
  })
}

resource "vault_kv_secret_v2" "postgresql_users" {
  count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_users_cfg.enabled, true) && local.postgresql_users_has_values ? 1 : 0

  mount = var.vault_kv_mount
  name  = "postgresql/users"

  data_json = jsonencode(local.postgresql_users_values)
}

resource "vault_kv_secret_v2" "postgresql_s3" {
  count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_s3_cfg.enabled, false) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "postgresql/s3"

  data_json = jsonencode({
    bucket     = trimspace(try(local.postgresql_s3_cfg.bucket, ""))
    endpoint   = trimspace(try(local.postgresql_s3_cfg.endpoint, "https://storage.yandexcloud.net"))
    region     = trimspace(try(local.postgresql_s3_cfg.region, "ru-central1"))
    access_key = trimspace(try(local.postgresql_s3_cfg.access_key, ""))
    secret_key = trimspace(try(local.postgresql_s3_cfg.secret_key, ""))
  })
}

resource "vault_kv_secret_v2" "postgresql_apps" {
  for_each = {
    for app, cfg in local.postgresql_apps :
    app => cfg if var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(cfg.enabled, true)
  }

  mount = var.vault_kv_mount
  name  = "postgresql/apps/${each.key}"

  data_json = jsonencode({
    username     = try(each.value.username, each.key)
    password     = try(each.value.password, "")
    password_key = try(each.value.password_key, each.key)
  })
}

resource "vault_kv_secret_v2" "rabbitmq_auth" {
  count = var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "rabbitmq/auth"

  data_json = jsonencode({
    username = try(local.rabbitmq_auth_cfg.username, "")
    password = local.rabbitmq_password
  })
}

resource "vault_kv_secret_v2" "rabbitmq_apps" {
  for_each = {
    for app, cfg in local.rabbitmq_apps :
    app => cfg if var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(cfg.enabled, true)
  }

  mount = var.vault_kv_mount
  name  = "rabbitmq/apps/${each.key}"

  data_json = jsonencode({
    username    = try(each.value.username, each.key)
    password    = try(each.value.password, "")
    vhost       = try(each.value.vhost, "/")
    permissions = try(each.value.permissions, { configure = ".*", write = ".*", read = ".*" })
    vhosts      = try(each.value.vhosts, [])
  })
}

resource "vault_kv_secret_v2" "minio_admin" {
  count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "minio/admin"

  data_json = jsonencode({
    rootUser     = local.minio_root_user
    rootPassword = local.minio_root_password
  })
}

resource "vault_kv_secret_v2" "minio_apps" {
  for_each = {
    for app, cfg in local.minio_apps :
    app => cfg if var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(cfg.enabled, true)
  }

  mount = var.vault_kv_mount
  name  = "minio/apps/${each.key}"

  data_json = jsonencode({
    username   = try(each.value.username, each.key)
    password   = try(each.value.password, "")
    access_key = try(each.value.access_key, try(each.value.username, each.key))
    secret_key = try(each.value.secret_key, try(each.value.password, ""))
    policy     = try(each.value.policy, "readwrite")
    buckets    = try(each.value.buckets, [])
    client     = try(each.value.client, {})
  })
}

resource "vault_kv_secret_v2" "kafka_bootstrap" {
  count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "kafka/bootstrap"

  data_json = jsonencode({
    clusterId           = local.kafka_cluster_id
    controllerPassword  = local.kafka_controller_password
    interBrokerPassword = local.kafka_inter_broker_password
  })
}

resource "vault_kv_secret_v2" "kafka_apps" {
  for_each = {
    for app, cfg in local.kafka_apps :
    app => cfg if var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(cfg.enabled, true)
  }

  mount = var.vault_kv_mount
  name  = "kafka/apps/${each.key}"

  data_json = jsonencode({
    username = try(each.value.username, each.key)
    password = try(each.value.password, "")
    auth     = try(each.value.auth, {})
    topics   = try(each.value.topics, [])
  })
}

resource "vault_kv_secret_v2" "zitadel_postgresql" {
  count = var.create_infra_secrets && try(local.zitadel_cfg.enabled, true) && try(local.zitadel_pg_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "zitadel/postgresql"

  data_json = jsonencode({
    password = local.zitadel_pg_password
  })
}

resource "vault_kv_secret_v2" "camunda_keycloak_admin" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_keycloak_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "camunda/keycloak-admin"

  data_json = jsonencode({
    "admin-password" = local.camunda_keycloak_admin_password
  })
}

resource "vault_kv_secret_v2" "camunda_identity_components" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "camunda/identity-components"

  data_json = jsonencode(local.camunda_identity_components)
}

resource "vault_kv_secret_v2" "camunda_identity_firstuser" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "camunda/identity-firstuser"

  data_json = jsonencode({
    "identity-firstuser-password" = local.camunda_identity_firstuser_password
  })
}

resource "vault_kv_secret_v2" "camunda_postgresql" {
  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "camunda/postgresql"

  data_json = jsonencode({
    password            = local.camunda_pg_password
    "postgres-password" = local.camunda_pg_postgres_password
  })
}

resource "vault_kv_secret_v2" "keycloak_admin" {
  count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "keycloak/admin"

  data_json = jsonencode({
    password = local.keycloak_admin_password
  })
}

resource "vault_kv_secret_v2" "keycloak_postgresql" {
  count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_pg_cfg.enabled, true) ? 1 : 0

  mount = var.vault_kv_mount
  name  = "keycloak/postgresql"

  data_json = jsonencode({
    host     = try(local.keycloak_pg_cfg.host, "")
    port     = tostring(try(local.keycloak_pg_cfg.port, ""))
    user     = try(local.keycloak_pg_cfg.user, "")
    database = try(local.keycloak_pg_cfg.database, "")
    password = local.keycloak_pg_password
  })
}

resource "vault_policy" "infra" {
  for_each = {
    for name, enabled in local.policy_enabled :
    name => name if var.create_infra_policies && enabled
  }

  name   = each.value
  policy = local.policy_docs[each.value]
}

resource "vault_kubernetes_auth_backend_role" "infra" {
  for_each = {
    for name, role in local.role_cfgs :
    name => role if var.create_infra_roles && try(local.policy_enabled[name], true) && try(role.enabled, true)
  }

  backend                          = var.kubernetes_auth_backend
  role_name                        = try(each.value.name, each.key)
  bound_service_account_names      = try(each.value.service_account_names, [])
  bound_service_account_namespaces = try(each.value.service_account_namespaces, [])
  token_ttl                        = can(tonumber(try(each.value.token_ttl, ""))) ? tonumber(each.value.token_ttl) : 86400
  token_policies                   = [try(each.value.name, each.key)]
}

resource "vault_kv_secret_v2" "application" {
  for_each = {
    for app, cfg in local.app_cfgs :
    app => cfg if(var.create_app_policies || var.create_app_roles) && trimspace(try(cfg.secret_path, "")) != "" && length(keys(try(cfg.secret_data, {}))) > 0
  }

  mount = var.vault_kv_mount
  name  = each.value.secret_path

  data_json = jsonencode(each.value.secret_data)
}

resource "vault_policy" "app" {
  for_each = {
    for app, cfg in local.app_cfgs :
    app => cfg if var.create_app_policies && length(cfg.read_paths) > 0
  }

  name   = try(each.value.policy_name, each.key)
  policy = local.app_policy_docs[each.key]
}

resource "vault_kubernetes_auth_backend_role" "app" {
  for_each = {
    for app, cfg in local.app_cfgs :
    app => cfg if var.create_app_roles && length(cfg.read_paths) > 0
  }

  backend                          = var.kubernetes_auth_backend
  role_name                        = try(each.value.role_name, each.key)
  bound_service_account_names      = try(each.value.service_account_names, [])
  bound_service_account_namespaces = try(each.value.service_account_namespaces, [])
  token_ttl                        = can(tonumber(try(each.value.token_ttl, ""))) ? tonumber(each.value.token_ttl) : 86400
  token_policies                   = [try(each.value.policy_name, each.key)]
}