locals {
  registry = "${var.region}-docker.pkg.dev/${var.project}/rarelens"

  # join("", ...) rather than one(...): with count = 0 these collapse to "" instead of null.
  db_credentials = "${join("", google_sql_user.api[*].name)}:${join("", random_password.pg[*].result)}"
  db_name        = join("", google_sql_database.rarelens[*].name)
  db_private_ip  = join("", google_sql_database_instance.pg[*].private_ip_address)

  # The API reaches Cloud SQL through its cloud-sql-proxy sidecar on localhost; pipeline tasks
  # (Google Batch VMs, Argo pods) use the private IP inside the VPC. With deploy_cloud_sql = false
  # both use the URL you supplied, which is expected to be reachable over TLS.
  api_database_url      = var.deploy_cloud_sql ? "postgresql+asyncpg://${local.db_credentials}@127.0.0.1:5432/${local.db_name}" : var.database_url
  pipeline_database_url = var.deploy_cloud_sql ? "postgresql://${local.db_credentials}@${local.db_private_ip}:5432/${local.db_name}" : var.database_url

  pipeline_sa_member = "serviceAccount:${google_service_account.pipeline.email}"
}