# the google side of the cloudflare workers in modules/envs. workers/<env> reads all of this
# back out of secret manager, so it never needs more than read access to the secrets
locals {
  cloudflare = try(local.env.cloudflare, null)
  workers    = try(local.env.workers, {})

  worker_identities = {
    for w, c in local.workers : w => c.google_identity if try(c.google_identity, null) != null
  }

  worker_secrets = toset(concat(
    local.cloudflare == null ? [] : [local.cloudflare.token_secret],
    flatten([for c in local.workers : values(try(c.secrets, {}))]),
  ))
}

resource "google_project_service" "workers" {
  for_each = toset(flatten([for i in local.worker_identities : i.apis]))

  project            = local.project
  service            = each.value
  disable_on_destroy = false
}

resource "google_service_account" "worker" {
  for_each = local.worker_identities

  project      = local.project
  account_id   = "${each.key}-${local.env.env_suffix}"
  display_name = "the ${each.key} cloudflare worker in ${var.env}"
}

# a worker can't federate, so it gets a real key. the readme says how to rotate it
resource "google_service_account_key" "worker" {
  for_each = local.worker_identities

  service_account_id = google_service_account.worker[each.key].name
}

resource "google_secret_manager_secret" "worker_key" {
  for_each = local.worker_identities

  project   = local.project
  secret_id = "${each.key}-google-key"

  replication {
    auto {}
  }

  depends_on = [google_project_service.this]
}

resource "google_secret_manager_secret_version" "worker_key" {
  for_each = local.worker_identities

  secret      = google_secret_manager_secret.worker_key[each.key].id
  secret_data = base64decode(google_service_account_key.worker[each.key].private_key)
}