terraform {
  required_providers {
    proxmox = {
      source  = "telmate/proxmox"
      version = "3.0.2-rc04"
    }
    local = {
      source  = "hashicorp/local"
      version = "~> 2.2"
    }
    technitium = {
      source  = "kenske/technitium"
      version = "~> 0.2"
    }
    # phpipam = {
    #   source  = "lord-kyron/phpipam"
    #   version = "1.6.2"
    # }
  }
}

provider "technitium" {
  host = var.technitium_host
  # Fall back to a placeholder so the provider passes its credential check on
  # the first run (before the token exists in Infisical). No technitium
  # resources are created while the token is absent, so the dummy is never used.
  token = coalesce(try(data.external.infisical.result["technitium_api_token"], ""), "token-not-yet-provisioned")
}

data "external" "infisical" {
  program = ["bash", "-c", "infisical export --template=./secrets.tmpl"]
}

# Uncomment when phpIPAM is running and credentials are in Infisical.
# provider "phpipam" {
#   app_id             = "tofu"
#   endpoint           = var.ipam_endpoint
#   username           = coalesce(try(data.external.infisical.result["ipam_username"], ""), "user-not-yet-provisioned")
#   password           = coalesce(try(data.external.infisical.result["ipam_password"], ""), "pass-not-yet-provisioned")
#   insecure           = false
#   nest_custom_fields = false
# }

provider "proxmox" {
  alias               = "proxmox"
  pm_api_url          = var.hypervisors["proxmox"].api_url
  pm_api_token_id     = data.external.infisical.result["token_id"]
  pm_api_token_secret = data.external.infisical.result["hv2_token_secret"]
  pm_tls_insecure     = true
}