# ── Secrets brought under Terraform management ────────────────────────────────
# These secrets were created manually (via gcloud or out-of-band provisioning)
# before the Terraform config was written. Secret values (versions) are NOT
# managed by Terraform — they were populated out-of-band and are left intact.
# Terraform owns the secret resource (metadata, replication, IAM) only.
#
# All resources here were imported via `terraform import` — they already exist
# in GCP. Do not add version resources unless you intend to rotate the value.

# ── Marketing / web services ──────────────────────────────────────────────────

resource "google_secret_manager_secret" "anthropic_api_key" {
  secret_id = "anthropic-api-key"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "resend_api_key" {
  secret_id = "resend-api-key"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "supabase_service_key" {
  secret_id = "supabase-service-key"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "docuseal_webhook_token" {
  secret_id = "docuseal-webhook-token"
  project   = var.project_id

  replication {
    auto {}
  }
}

# ── Stripe price IDs (old naming scheme) ─────────────────────────────────────
# These predate the stripe-price-*-plan naming in stripe-billing.tf.
# Consumed by marketing-prod-* and accounts-prod-* Cloud Run services.

resource "google_secret_manager_secret" "stripe_price_professional" {
  secret_id = "stripe-price-professional"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_founding" {
  secret_id = "stripe-price-founding"
  project   = var.project_id

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret" "stripe_price_family_child" {
  secret_id = "stripe-price-family-child"
  project   = var.project_id

  replication {
    auto {}
  }
}

# ── CI infrastructure ─────────────────────────────────────────────────────────

resource "google_secret_manager_secret" "gitea_runner_token" {
  secret_id = "gitea-runner-token"
  project   = var.project_id

  replication {
    auto {}
  }
}