resource "local_sensitive_file" "ssh_private_key" {
  filename        = "${path.module}/.ssh_key"
  content_base64  = data.external.infisical.result["ssh_private_key_b64"]
  file_permission = "0600"
}

locals {
  # Shared inputs passed to every proxmox_node module call.
  node_common = {
    search_domain   = var.search_domain
    dns_nameservers = var.dns_nameservers
    ssh_key         = data.external.infisical.result["ssh_public_key"]
    ansible_user    = var.ansible_user
    lxc_password    = data.external.infisical.result["lxc_password"]
  }
}

# Provider aliases must be statically declared, so each hypervisor needs its
# own module block. To add or remove a hypervisor, add/remove the corresponding
# provider alias in providers.tf and a module block here. Everything else
# (node contents, common config) lives in the parent repo's terraform.tfvars.

module "proxmox" {
  source = "./opentofu/modules/proxmox_node"

  node_name       = var.hypervisors["proxmox"].node_name
  storage         = var.hypervisors["proxmox"].storage
  lxc             = try(var.nodes["proxmox"].lxc, {})
  machines        = try(var.nodes["proxmox"].machines, {})
  search_domain   = local.node_common.search_domain
  dns_nameservers = local.node_common.dns_nameservers
  ssh_key         = local.node_common.ssh_key
  ansible_user    = local.node_common.ansible_user
  lxc_password    = local.node_common.lxc_password

  providers = {
    proxmox = proxmox.proxmox
  }
}

locals {
  hv_hosts = {
    proxmox = { lxc = module.proxmox.lxc_hosts, vm = module.proxmox.vm_hosts }
  }

  all_hosts = flatten([
    for hv_name, hv in local.hv_hosts : [
      for h in concat(hv.lxc, hv.vm) : [
        for tag in h.filtered_tags : {
          tag  = tag
          name = h.name
          ip   = h.ip
          vmid = h.vmid
        }
      ]
    ]
  ])

  tag_groups = {
    for tag in distinct([for h in local.all_hosts : h.tag]) :
    tag => [
      for h in local.all_hosts : {
        name = h.name
        ip   = h.ip
        vmid = h.vmid
      } if h.tag == tag
    ]
  }
}

resource "local_file" "ansible_inventory" {
  filename = "${path.module}/${var.ansible_inventory_path}"
  content  = templatefile("${path.module}/opentofu/inventory.tpl", {
    hypervisors                  = local.hv_hosts
    tag_groups                   = local.tag_groups
    ansible_user                 = var.ansible_user
    ansible_ssh_private_key_file = local_sensitive_file.ssh_private_key.filename
  })
}