locals {
  data_path = "${var.persistent_folder}/sftpgo"


  sftpgo_config = {
    common = {
      defender = {
        enabled = false
      }
    },
    sftpd = {
      bindings = [
        {
          port = 0
        }
      ]
    },
    webdavd = {
      bindings = [
        {
          port                 = 8081
          address              = "0.0.0.0"
          enable_https         = var.tls_enabled
          certificate_file     = "/etc/ssl/certs/private/tls.crt"
          certificate_key_file = "/etc/ssl/certs/private/tls.key"
        }
      ]
    },
    data_provider = {
      create_default_admin = true
      backups_path         = "/var/lib/sftpgo/backup"
    },
    httpd = {
      bindings = [
        {
          port                 = 8080
          address              = "0.0.0.0"
          enable_https         = var.tls_enabled
          certificate_file     = "/etc/ssl/certs/private/tls.crt"
          certificate_key_file = "/etc/ssl/certs/private/tls.key"
          branding = {
            web_client = {
              name       = "alexpires.me cloud"
              short_name = "alexpires.me"
            },
            web_admin = {
              name       = "alexpires.me cloud"
              short_name = "alexpires.me"
            }
          }
        }
      ],
      web_root = "/config/dav",
    },
    telemetry = {
      bind_port    = 10000
      bind_address = "0.0.0.0"
    },
    mfa = {
      totp = [
        {
          name   = "Default",
          issuer = "alexpires.me"
          algo   = "sha1"
        }
      ]
    },
    smtp = {
      host       = var.smtp_host,
      port       = var.smtp_port,
      from       = var.from_email
      encryption = 1,
      domain     = "alexpires.me"
    },
    plugins = []
  }

  config          = jsonencode(local.sftpgo_config)
  config_checksum = sha256(local.config)

  credentials = templatefile("${path.module}/resources/aws.tpl", {
    access_key = var.access_key
    secret_key = var.secret_key
  })
  credentials_checksum = sha256(local.credentials)
}