# ── Outputs ───────────────────────────────────────────────────────────────────
# After `terraform apply`, use prod_lb_ip for Cloudflare DNS A records.
#
# All three services share the same global anycast IP (prod_lb_ip).
# Set these A records in Cloudflare (proxied=true for CDN + DDoS):
#   neurontechnologies.ai       → prod_lb_ip
#   www.neurontechnologies.ai   → prod_lb_ip
#   api.neurontechnologies.ai   → prod_lb_ip
#   accounts.neurontechnologies.ai → prod_lb_ip

output "prod_lb_ip" {
  description = "Global anycast IP for all prod services (marketing, accounts, api)"
  value       = google_compute_global_address.prod.address
}

output "prod_ssl_cert_name" {
  description = "Marketing SSL cert (check provisioning status in GCP console)"
  value       = google_compute_managed_ssl_certificate.prod.name
}

output "accounts_ssl_cert_name" {
  description = "Accounts SSL cert (check provisioning status in GCP console)"
  value       = google_compute_managed_ssl_certificate.accounts.name
}

output "api_ssl_cert_name" {
  description = "API SSL cert (check provisioning status in GCP console)"
  value       = google_compute_managed_ssl_certificate.api.name
}

output "marketing_service_account_email" {
  description = "Marketing Cloud Run SA"
  value       = google_service_account.marketing.email
}

output "accounts_service_account_email" {
  description = "Accounts Cloud Run SA"
  value       = google_service_account.accounts.email
}

output "api_service_account_email" {
  description = "API Cloud Run SA"
  value       = google_service_account.api.email
}

output "ci_pusher_email" {
  description = "CI SA email — use to create the JSON key for GCP_SA_KEY Gitea secret"
  value       = google_service_account.ci_pusher.email
}

output "cloud_sql_connection_name" {
  description = "Cloud SQL instance connection name — use in Cloud Run volume mounts"
  value       = google_sql_database_instance.main.connection_name
}

output "cloud_sql_instance_ip" {
  description = "Cloud SQL public IP (for bastion/migration access — disable when not needed)"
  value       = google_sql_database_instance.main.public_ip_address
}

output "cloud_run_services" {
  description = "Cloud Run service URLs per service and region"
  value = {
    marketing_us   = google_cloud_run_v2_service.prod_us.uri
    marketing_eu   = google_cloud_run_v2_service.prod_eu.uri
    marketing_apac = google_cloud_run_v2_service.prod_apac.uri
    accounts_us    = google_cloud_run_v2_service.accounts_us.uri
    accounts_eu    = google_cloud_run_v2_service.accounts_eu.uri
    accounts_apac  = google_cloud_run_v2_service.accounts_apac.uri
    api_us         = google_cloud_run_v2_service.api_us.uri
    api_eu         = google_cloud_run_v2_service.api_eu.uri
    api_apac       = google_cloud_run_v2_service.api_apac.uri
    soma_us        = google_cloud_run_v2_service.soma_us.uri
  }
}

output "artifact_registry_urls" {
  description = "Docker image base URLs for each service"
  value = {
    marketing = "us-central1-docker.pkg.dev/${var.project_id}/neuron-marketing/marketing"
    accounts  = "us-central1-docker.pkg.dev/${var.project_id}/neuron-accounts/accounts"
    api       = "us-central1-docker.pkg.dev/${var.project_id}/neuron-api/api"
    soma      = "us-central1-docker.pkg.dev/${var.project_id}/neuron-soma/soma"
  }
}

output "soma_service_url" {
  description = "Soma Cloud Run service URL (us-central1)"
  value       = google_cloud_run_v2_service.soma_us.uri
}

output "soma_artifact_registry_url" {
  description = "Soma Docker image base URL in Artifact Registry"
  value       = "us-central1-docker.pkg.dev/${var.project_id}/neuron-soma/soma"
}

output "soma_ssl_cert_name" {
  description = "Soma SSL cert (check provisioning status in GCP console)"
  value       = google_compute_managed_ssl_certificate.soma.name
}