# Vault — secrets management with GCP KMS auto-unseal
# UI: https://vault.neuralplatform.ai
# Auto-unseal: GCP KMS projects/neuron-785695/locations/global/keyRings/vault/cryptoKeys/vault-unseal

resource "kubernetes_namespace" "vault" {
  metadata {
    name = "vault"
    labels = {
      managed-by = "terraform"
      tier       = "platform"
    }
  }
}

resource "kubernetes_secret" "vault_gcp_sa" {
  metadata {
    name      = "vault-gcp-sa"
    namespace = kubernetes_namespace.vault.metadata[0].name
  }

  data = {
    "sa.json" = file("${path.module}/vault-gcp-sa.json")
  }
}

resource "helm_release" "vault" {
  name       = "vault"
  namespace  = kubernetes_namespace.vault.metadata[0].name
  repository = "https://helm.releases.hashicorp.com"
  chart      = "vault"
  version    = "0.29.1"
  timeout    = 300

  values = [<<-EOT
    server:
      image:
        repository: hashicorp/vault
        tag: "1.18.3"

      extraEnvironmentVars:
        GOOGLE_APPLICATION_CREDENTIALS: /vault/gcp/sa.json

      volumes:
        - name: gcp-sa
          secret:
            secretName: vault-gcp-sa

      volumeMounts:
        - name: gcp-sa
          mountPath: /vault/gcp
          readOnly: true

      ha:
        enabled: false

      dataStorage:
        enabled: true
        size: 10Gi

      standalone:
        enabled: true
        config: |
          ui = true

          listener "tcp" {
            tls_disable = 1
            address     = "[::]:8200"
            cluster_address = "[::]:8201"
          }

          storage "file" {
            path = "/vault/data"
          }

          seal "gcpckms" {
            project    = "neuron-785695"
            region     = "global"
            key_ring   = "vault"
            crypto_key = "vault-unseal"
          }

      ingress:
        enabled: true
        ingressClassName: traefik
        annotations:
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: vault.${var.infra_domain}
            paths:
              - /
        tls:
          - secretName: vault-tls
            hosts:
              - vault.${var.infra_domain}

    ui:
      enabled: true

    injector:
      enabled: false
  EOT
  ]

  depends_on = [
    kubernetes_secret.vault_gcp_sa,
    helm_release.cert_manager,
  ]
}