locals {
  valheim_relay_fragment = templatefile("${path.root}/templates/valheim-relay.nft.tftpl", {
    wg_peer_ip   = var.wg_peer_ip
    wg_peer_ipv6 = var.wg_peer_ipv6
  })

  valheim_relay_asset_hash = sha256(jsonencode({
    fragment = filesha256("${path.root}/templates/valheim-relay.nft.tftpl")
    local    = filesha256("${path.root}/scripts/local/deploy-valheim-relay.sh")
    remote   = filesha256("${path.root}/scripts/remote/apply-valheim-relay.sh")
  }))
}

resource "terraform_data" "valheim_relay_ingress" {
  triggers_replace = {
    assets_hash  = local.valheim_relay_asset_hash
    relay_id     = hcloud_server.this.id
    relay_ipv4   = hcloud_server.this.ipv4_address
    relay_ipv6   = hcloud_server.this.ipv6_address
    firewall_id  = hcloud_firewall.this.id
    wg_peer_ip   = var.wg_peer_ip
    wg_peer_ipv6 = var.wg_peer_ipv6
    ssh_port     = var.ssh_port
  }

  depends_on = [
    hcloud_firewall.this,
    hcloud_server.this,
  ]

  provisioner "local-exec" {
    interpreter = ["/bin/bash", "-c"]
    # Existing operator alias preserves its verified host key and authentication.
    command = "${abspath(path.root)}/scripts/local/deploy-valheim-relay.sh alpha ${var.ssh_port}"
    environment = {
      VALHEIM_RELAY_FRAGMENT = local.valheim_relay_fragment
    }
  }
}