resource "google_sql_database_instance" "pg" {
  count               = var.deploy_cloud_sql ? 1 : 0
  name                = "rarelens-pg"
  database_version    = "POSTGRES_16"
  region              = var.region
  deletion_protection = var.deletion_protection
  depends_on          = [google_service_networking_connection.private_services]

  settings {
    tier              = "db-f1-micro" # lab budget; bump for real use
    availability_type = "ZONAL"
    backup_configuration { enabled = true }
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.vpc.id
    }
  }
}

resource "google_sql_database" "rarelens" {
  count    = var.deploy_cloud_sql ? 1 : 0
  name     = "rarelens"
  instance = google_sql_database_instance.pg[0].name
}

resource "google_sql_user" "api" {
  count    = var.deploy_cloud_sql ? 1 : 0
  name     = "rarelens"
  instance = google_sql_database_instance.pg[0].name
  password = random_password.pg[0].result
}

resource "random_password" "pg" {
  count   = var.deploy_cloud_sql ? 1 : 0
  length  = 32
  special = false # embedded in DATABASE_URL, where characters like @ / # % would break parsing
}