resource "random_password" "metadb" {
  count = local.metadb_enabled ? 1 : 0

  length  = var.metadb_password_length
  special = false
  upper   = true
  numeric = true
}

resource "aws_secretsmanager_secret" "metadb" {
  count = local.metadb_enabled ? 1 : 0

  name                    = "cp9/${local.session_name}/metadb"
  description             = "cp9 ${local.session_name} metadb credentials"
  recovery_window_in_days = 0

  tags = merge(local.common_tags, {
    Name = "cp9-${local.session_name}-metadb"
  })
}

resource "aws_secretsmanager_secret_version" "metadb" {
  count = local.metadb_enabled ? 1 : 0

  secret_id = aws_secretsmanager_secret.metadb[0].id
  secret_string = jsonencode({
    database = local.metadb_database
    host     = local.metadb_host
    password = random_password.metadb[0].result
    port     = local.metadb_port
    username = local.metadb_user
  })
}