# ── Vault KMS Auto-Unseal ─────────────────────────────────────────────────────
# Vault running on Legion uses GCP KMS for auto-unseal. Configured in:
#   servers/legion/apps/vault.yaml (seal "gcpckms" block)
# Key ring: vault, key: vault-unseal, location: global
#
# CRITICAL: prevent_destroy = true on the crypto key.
# Deleting this key makes Vault permanently sealed — all secrets inaccessible.
#
# These resources were created manually and are imported into TF state.
# Values already exist in GCP — TF is just taking ownership.

resource "google_kms_key_ring" "vault" {
  name     = "vault"
  location = "global"
  project  = var.project_id
}

resource "google_kms_crypto_key" "vault_unseal" {
  name            = "vault-unseal"
  key_ring        = google_kms_key_ring.vault.id
  purpose         = "ENCRYPT_DECRYPT"
  rotation_period = "7776000s" # 90 days

  lifecycle {
    prevent_destroy = true
  }
}

resource "google_service_account" "vault_unseal" {
  account_id   = "vault-unseal"
  display_name = "Vault KMS Auto-Unseal"
  description  = "Service account for Vault auto-unseal via GCP KMS. Used by the Vault pod on Legion."
  project      = var.project_id
}

resource "google_kms_crypto_key_iam_member" "vault_unseal_encrypter_decrypter" {
  crypto_key_id = google_kms_crypto_key.vault_unseal.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:${google_service_account.vault_unseal.email}"
}

resource "google_kms_crypto_key_iam_member" "vault_unseal_viewer" {
  crypto_key_id = google_kms_crypto_key.vault_unseal.id
  role          = "roles/cloudkms.viewer"
  member        = "serviceAccount:${google_service_account.vault_unseal.email}"
}