resource "aws_secretsmanager_secret" "db_credentials" {
  name = "${local.name_prefix}/db-credentials"
}

resource "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = aws_secretsmanager_secret.db_credentials.id

  secret_string = jsonencode({
    username = var.db_username
    password = var.db_password
  })
}

resource "aws_secretsmanager_secret" "app" {
  name = "${local.name_prefix}/app-secrets"
}

resource "aws_secretsmanager_secret_version" "app" {
  secret_id = aws_secretsmanager_secret.app.id

  secret_string = jsonencode({
    AUTH_SECRET   = var.auth_secret
    NEXTAUTH_URL  = "https://${var.domain_name}"
    SMTP_HOST     = var.smtp_host
    SMTP_PORT     = var.smtp_port
    SMTP_USER     = var.smtp_user
    SMTP_PASS     = var.smtp_pass
    SMTP_FROM     = var.smtp_from
    DATABASE_URL  = "postgresql://${var.db_username}:${var.db_password}@${aws_db_proxy.main.endpoint}:5432/${local.db_name}?schema=public&pgbouncer=true&connection_limit=5"
    WORKER_DATABASE_URL = "postgresql://${var.db_username}:${var.db_password}@${aws_db_instance.postgres.address}:5432/${local.db_name}?schema=public"
    REDIS_URL     = "redis://${aws_elasticache_replication_group.main.primary_endpoint_address}:6379"
  })
}