resource "scaleway_object_bucket" "infra_assets" {
  name       = "a13labs-infra-${var.bucket_suffix}"
  project_id = var.scaleway_project_id
  region     = "fr-par"
}

resource "scaleway_object_bucket_policy" "policy" {
  bucket = scaleway_object_bucket.infra_assets.name
  policy = jsonencode({
    Version = "2023-04-17",
    Id      = "AllowMachineDownload",
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:ListBucket",
          "s3:GetObject",
        ]
        Principal = "*"
        Resource = [
          scaleway_object_bucket.infra_assets.name,
          "${scaleway_object_bucket.infra_assets.name}/*",
        ]
        Condition = {
          IpAddress = {
            "aws:SourceIp" = local.instance_ips
          }
        },
      },
      {
        Effect = "Allow"
        Action = [
          "s3:*",
        ]
        Principal = {
          SCW = "user_id:${var.scaleway_user_id}"
        }
        Resource = [
          scaleway_object_bucket.infra_assets.name,
          "${scaleway_object_bucket.infra_assets.name}/*",
        ]
      },
    ]
  })
}

resource "scaleway_object" "encryption_key" {
  bucket = scaleway_object_bucket.infra_assets.id
  key    = "keys/${replace(data.contabo_instance.microk8s.mac_address, ":", "_")}.key"

  content_base64 = base64encode(var.encryption_key)
}