#!/bin/bash
set -e

cd "$(dirname "$0")/.."

echo "=== Terraform Bootstrap Setup ==="

if [ ! -f "../.env" ]; then
  echo "ERROR: ../.env not found. Run from terraform/ directory."
  exit 1
fi

# Extract MinIO credentials from .env
export AWS_ACCESS_KEY_ID=$(grep "^MINIO_ROOT_USER=" ../.env | cut -d= -f2)
export AWS_SECRET_ACCESS_KEY=$(grep "^MINIO_ROOT_PASSWORD=" ../.env | cut -d= -f2)
export KUBECONFIG=$(pwd)/../cluster-config/kubeconfig

if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
  echo "ERROR: MINIO_ROOT_USER or MINIO_ROOT_PASSWORD not found in .env"
  exit 1
fi

echo "✓ MinIO S3 credentials loaded"

# Check Vault token
if [ -z "$VAULT_TOKEN" ]; then
  echo "WARNING: VAULT_TOKEN not set. Set it before terraform init:"
  echo "  export VAULT_TOKEN=\$(vault login -method=oidc ...)"
fi

# Generate terraform.tfvars from .env
echo "Generating terraform.tfvars from .env..."
cat > terraform.tfvars.local << 'EOF'
# Auto-generated from .env
EOF

grep -E '^(AUTHENTIK_SECRET_KEY|AUTHENTIK_BOOTSTRAP_PASSWORD|AUTHENTIK_BOOTSTRAP_TOKEN|AUTHENTIK_PG_PASSWORD|POSTGRES_PASSWORD|MINIO_ROOT_|GRAFANA_|FORGEJO_|ARGOCD_)' ../.env | sed 's/_ROOT_USER=/=/' | while read line; do
  key=$(echo "$line" | cut -d= -f1 | sed 's/_/ /g; s/.*/\L&/; s/ /_/g')
  val=$(echo "$line" | cut -d= -f2-)
  if [[ "$key" == *"secret"* ]] || [[ "$key" == *"password"* ]]; then
    echo "$key = \"$val\"" >> terraform.tfvars.local
  else
    echo "$key = \"$val\"" >> terraform.tfvars.local
  fi
done

echo "✓ terraform.tfvars.local generated"

# Initialize terraform
echo "Initializing terraform with S3 backend..."
terraform init \
  -backend-config="access_key=$AWS_ACCESS_KEY_ID" \
  -backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"

echo "✓ Terraform initialized"
echo ""
echo "Next steps:"
echo "  1. Review: terraform plan"
echo "  2. Import existing resources: ./scripts/import-existing.sh"
echo "  3. Apply: terraform apply"