# ── DocuSeal GKE service account and Workload Identity ───────────────────────
# DocuSeal runs in the `docuseal` namespace on GKE. It accesses GCP Secret
# Manager via Workload Identity — no JSON key files.
#
# Secret flow: Vault → GCP Secret Manager → ExternalSecret → k8s Secret → pod

resource "google_service_account" "docuseal_gke" {
  account_id   = "docuseal-gke"
  display_name = "DocuSeal GKE"
  description  = "Identity for DocuSeal pod on GKE. Accesses Secret Manager via Workload Identity."
  project      = var.project_id
}

# ── Secret Manager access ─────────────────────────────────────────────────────

resource "google_secret_manager_secret_iam_member" "docuseal_secret_key_base" {
  project   = var.project_id
  secret_id = "docuseal-secret-key-base"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

resource "google_secret_manager_secret_iam_member" "docuseal_smtp_host" {
  project   = var.project_id
  secret_id = "docuseal-smtp-host"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

resource "google_secret_manager_secret_iam_member" "docuseal_smtp_port" {
  project   = var.project_id
  secret_id = "docuseal-smtp-port"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

resource "google_secret_manager_secret_iam_member" "docuseal_smtp_username" {
  project   = var.project_id
  secret_id = "docuseal-smtp-username"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

resource "google_secret_manager_secret_iam_member" "docuseal_smtp_password" {
  project   = var.project_id
  secret_id = "docuseal-smtp-password"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

resource "google_secret_manager_secret_iam_member" "docuseal_smtp_from" {
  project   = var.project_id
  secret_id = "docuseal-smtp-from"
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.docuseal_gke.email}"
}

# ── Workload Identity binding ─────────────────────────────────────────────────
# The k8s SA `docuseal` in the `docuseal` namespace can impersonate this GCP SA.
# ESO uses this to authenticate to Secret Manager without a key file.

resource "google_service_account_iam_member" "docuseal_workload_identity" {
  service_account_id = google_service_account.docuseal_gke.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "serviceAccount:${var.project_id}.svc.id.goog[docuseal/docuseal]"

  depends_on = [google_container_cluster.neuron_platform]
}