resource "random_password" "jwt_secret" {
  length  = 64
  special = false
}

resource "random_password" "db_password" {
  length  = 32
  special = false
}

resource "scaleway_secret" "jwt" {
  name       = "foxhunt-jwt-secret"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "jwt" {
  secret_id = scaleway_secret.jwt.id
  data      = base64encode(random_password.jwt_secret.result)
  region    = var.region
}

resource "scaleway_secret" "db_password" {
  name       = "foxhunt-db-password"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "db_password" {
  secret_id = scaleway_secret.db_password.id
  data      = base64encode(random_password.db_password.result)
  region    = var.region
}

resource "scaleway_secret" "tailscale_api_key" {
  name       = "foxhunt-tailscale-api-key"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "tailscale_api_key" {
  secret_id = scaleway_secret.tailscale_api_key.id
  data      = base64encode(var.tailscale_api_key)
  region    = var.region
}

# IBKR paper trading credentials (passed via environment variables, never hardcoded)

resource "scaleway_secret" "ibkr_account" {
  name       = "foxhunt-ibkr-account"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "ibkr_account" {
  secret_id = scaleway_secret.ibkr_account.id
  data      = base64encode(var.ibkr_account_id)
  region    = var.region
}

resource "scaleway_secret" "ibkr_username" {
  name       = "foxhunt-ibkr-username"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "ibkr_username" {
  secret_id = scaleway_secret.ibkr_username.id
  data      = base64encode(var.ibkr_username)
  region    = var.region
}

resource "scaleway_secret" "ibkr_password" {
  name       = "foxhunt-ibkr-password"
  project_id = var.project_id
  region     = var.region
}

resource "scaleway_secret_version" "ibkr_password" {
  secret_id = scaleway_secret.ibkr_password.id
  data      = base64encode(var.ibkr_password)
  region    = var.region
}