terraform {
  required_providers {
    proxmox = {
      source  = "bpg/proxmox"
      version = "~> 0.61.0"
    }
  }
}



# Resource Pools

# Creates logical groups for organizing and securing VMs.
resource "proxmox_virtual_environment_pool" "core" {
  pool_id = "core"
  comment = "Critical, public-facing services (reverse proxy, DNS)"
}

resource "proxmox_virtual_environment_pool" "production" {
  pool_id = "production"
  comment = "Stable services with backup strategies"
}

resource "proxmox_virtual_environment_pool" "dev" {
  pool_id = "dev"
  comment = "Persistent but non-production services, run 24/7"
}

resource "proxmox_virtual_environment_pool" "staging" {
  pool_id = "staging"
  comment = "Ephemeral test VMs managed by Pull-Based PR webhooks"
}

# API Tokens for Control Center

# Creates a restricted user for the Control Center VM to manage the cluster.
resource "proxmox_virtual_environment_role" "control_center_role" {
  role_id = "ControlCenter"

  privileges = [
    "VM.Allocate",
    "VM.Audit",
    "VM.Clone",
    "VM.Config.CDROM",
    "VM.Config.CPU",
    "VM.Config.Disk",
    "VM.Config.HWType",
    "VM.Config.Memory",
    "VM.Config.Network",
    "VM.Config.Options",
    "VM.Monitor",
    "VM.PowerMgmt",
    "Datastore.AllocateSpace",
    "Datastore.Audit",
    "SDN.Use"
  ]
}

resource "proxmox_virtual_environment_user" "control_center_user" {
  user_id = "control-center@pve"
  comment = "Managed by OpenTofu - Used by Control Center for GitOps"
}

# Grant full VM access to the control center
resource "proxmox_virtual_environment_acl" "control_center_vms" {
  user_id = proxmox_virtual_environment_user.control_center_user.user_id
  role_id = proxmox_virtual_environment_role.control_center_role.role_id
  path    = "/vms"
}

# Grant datastore access
resource "proxmox_virtual_environment_acl" "control_center_storage" {
  user_id = proxmox_virtual_environment_user.control_center_user.user_id
  role_id = proxmox_virtual_environment_role.control_center_role.role_id
  path    = "/storage/${var.zfs_pool_name}"
}

resource "proxmox_virtual_environment_user_token" "control_center_token" {
  user_id    = proxmox_virtual_environment_user.control_center_user.user_id
  token_name = "gitops"
  comment    = "Stored only on the Control Center VM"
}

output "control_center_api_token" {
  value       = proxmox_virtual_environment_user_token.control_center_token.value
  sensitive   = true
  description = "The secret API token for control-center@pve. This will be injected into the Control Center SOPS config."
}