# Copied into Kubernetes secrets by `make gcp-secrets PROJECT=<id>`.
resource "google_secret_manager_secret" "api_database_url" {
  secret_id = "rarelens-api-database-url"
  replication {
    auto {}
  }
  depends_on = [google_project_service.enabled]
}

resource "google_secret_manager_secret_version" "api_database_url" {
  secret      = google_secret_manager_secret.api_database_url.id
  secret_data = local.api_database_url

  lifecycle {
    precondition {
      condition     = var.deploy_cloud_sql || var.database_url != ""
      error_message = "Set database_url (e.g. a Neon URL), or deploy_cloud_sql = true."
    }
  }
}

# The id must match the Nextflow `secret = 'DATABASE_URL'` directive in pipeline/nextflow.config:
# on Google Batch, Nextflow resolves secrets from Secret Manager by name.
resource "google_secret_manager_secret" "pipeline_database_url" {
  secret_id = "DATABASE_URL"
  replication {
    auto {}
  }
  depends_on = [google_project_service.enabled]
}

resource "google_secret_manager_secret_version" "pipeline_database_url" {
  secret      = google_secret_manager_secret.pipeline_database_url.id
  secret_data = local.pipeline_database_url
}

resource "google_secret_manager_secret_iam_member" "pipeline_database_url" {
  secret_id = google_secret_manager_secret.pipeline_database_url.id
  role      = "roles/secretmanager.secretAccessor"
  member    = local.pipeline_sa_member
}