---
# Buckets
apiVersion: minio.min.io/v1alpha1
kind: Bucket
metadata:
  name: riotpiao-models
  namespace: storage
spec:
  name: riotpiao-models
  versioning:
    enabled: true
  tags:
    app: ollama
    layer: applications
    purpose: model-storage

---
# Policies: define access scopes
apiVersion: minio.min.io/v1alpha1
kind: Policy
metadata:
  name: policy-ollama
  namespace: storage
spec:
  name: policy-ollama
  statements:
    - Effect: Allow
      Action:
        - s3:GetObject
        - s3:PutObject
      Resource:
        - arn:aws:s3:::riotpiao-models/*
    - Effect: Allow
      Action:
        - s3:ListBucket
      Resource:
        - arn:aws:s3:::riotpiao-models

---
# Users: service accounts with scoped access
apiVersion: minio.min.io/v1alpha1
kind: User
metadata:
  name: user-ollama
  namespace: storage
spec:
  accessKey: ollama-access-key
  secretKey: ollama-secret-key-changeme  # Override via Secret
  policies:
    - policy-ollama
  status: enabled
  memberOf: []

---
# Future buckets
# - terraform-state: for Terraform state
# - logs: for application logs
# - artifacts: for CI/CD artifacts
# - backups: for database backups

# Future users
# - terraform: read/write terraform-state
# - logging: write logs
# - ci-cd: write artifacts
# - backups: write backups