module "app_roles" {
  source = "git::ssh://git@192.168.1.202:2222/arcodange-org/tools.git//hashicorp-vault/iac/modules/app_roles?depth=1&ref=main"
  name = "plausible"
  service_account_namespaces = ["tools"]
}

# https://github.com/plausible/community-edition/wiki/configuration#database

#SECRET_KEY_BASE (openssl rand -base64 48)
#

resource "random_password" "secret" {
  for_each = toset(["48","32"])
  length  = tonumber(each.value)
  special = false
}
locals {
  config = {
    SECRET_KEY_BASE = base64encode(random_password.secret["48"].result)
    TOTP_VAULT_KEY = base64encode(random_password.secret["32"].result)
  }
}

resource "vault_kv_secret_v2" "config" {
  mount                      = "kvv2"
  name                       = "plausible/config"
  cas                        = 1
#   delete_all_versions        = true
  data_json                  = jsonencode(local.config)
}