terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.26"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.12"
    }
  }

  # Der State-Pfad pro Umgebung wird beim init gesetzt:
  #   terraform init -backend-config=envs/test.backend.hcl   (k3s,   terraform/states/boday_tf – unverändert)
  #   terraform init -backend-config=envs/prod.backend.hcl   (Talos, terraform/states/boday_tf_prod)
  backend "consul" {
    address = "consul:8500"
  }
}

# --- Variablen ---------------------------------------------------------------

variable "app_version" {
  description = "Image-Tag (Git-SHA aus der Pipeline)"
  type        = string
  default     = "latest"
}

variable "environment" {
  description = "test (k3s) oder prod (Talos)"
  type        = string
}

variable "kubeconfig_path" {
  type    = string
  default = "./kind_kubeconfig"
}

# Nur für k3s nötig (überschreibt den Server aus der Kubeconfig). Bei Talos null lassen.
variable "kube_host" {
  type    = string
  default = null
}

# k3s-Test: true. Talos: false – die Kubeconfig von talosctl enthält die CA.
variable "kube_insecure" {
  type    = bool
  default = false
}

variable "namespace" {
  type    = string
  default = "default"
}

# Leer = Wert aus values.yaml bleibt (k3s-Test). Für Prod als Forgejo-Secret übergeben.
variable "django_secret_key" {
  type      = string
  default   = ""
  sensitive = true
}

variable "postgres_password" {
  type      = string
  default   = ""
  sensitive = true
}

# --- Provider ----------------------------------------------------------------

provider "kubernetes" {
  config_path = var.kubeconfig_path
  host        = var.kube_host
  insecure    = var.kube_insecure
}

provider "helm" {
  kubernetes {
    config_path = var.kubeconfig_path
    host        = var.kube_host
    insecure    = var.kube_insecure
  }
}

# --- Deployment --------------------------------------------------------------

resource "helm_release" "boday_website" {
  name             = "boday-it"
  chart            = "./charts/boday-it"
  namespace        = var.namespace
  create_namespace = var.namespace != "default"

  # Umgebungsspezifische Werte (Ingress-Klasse, StorageClass, ...)
  values = [file("${path.module}/charts/boday-it/values-${var.environment}.yaml")]

  set {
    name  = "image.tag"
    value = var.app_version
  }

  # Secrets nur setzen, wenn sie übergeben wurden (sonst gilt values.yaml).
  # nonsensitive() gibt nur "gesetzt ja/nein" frei, nicht den Wert selbst.
  dynamic "set_sensitive" {
    for_each = nonsensitive(var.django_secret_key != "") ? ["secrets.djangoSecretKey"] : []
    content {
      name  = set_sensitive.value
      value = var.django_secret_key
    }
  }

  dynamic "set_sensitive" {
    for_each = nonsensitive(var.postgres_password != "") ? ["secrets.postgresPassword"] : []
    content {
      name  = set_sensitive.value
      value = var.postgres_password
    }
  }
}