# Adopt the already-running OpenBao configuration into Terraform state.
#
# These use TF 1.5 `import` blocks rather than `terraform import` CLI calls so
# the adoption is reviewable: `terraform plan` shows exactly what Terraform
# thinks differs from reality BEFORE anything is written.
#
# The plan should be "N to import, 0 to destroy". Anything proposing a DESTROY
# or a replace means the HCL does not match the live object — fix the HCL, never
# apply through it. Destroying the pki mount would take the root CA with it.
#
# Once applied, these blocks are inert and can be deleted.

import {
  to = vault_mount.kv
  id = "kv"
}

import {
  to = vault_mount.pki
  id = "pki"
}

import {
  to = vault_mount.ssh_client_signer
  id = "ssh-client-signer"
}

import {
  to = vault_pki_secret_backend_role.bao_server
  id = "pki/roles/bao-server"
}

import {
  to = vault_ssh_secret_backend_role.ai_agent
  id = "ssh-client-signer/roles/ai-agent"
}

import {
  # NOTE: vault_auth_backend imports by the BARE path ("oidc"), not the
  # API-prefixed "auth/oidc" — the latter gives "Cannot import non-existent
  # remote object". The ROLE below does use the full path, which is the
  # inconsistency that makes this easy to get wrong.
  to = vault_auth_backend.oidc
  id = "oidc"
}

import {
  to = vault_jwt_auth_backend_role.admin
  id = "auth/oidc/role/admin"
}

import {
  to = vault_policy.admin
  id = "admin"
}

import {
  to = vault_policy.ai_agent_ssh
  id = "ai-agent-ssh"
}

import {
  to = vault_policy.snapshot
  id = "snapshot"
}

import {
  to = vault_pki_secret_backend_config_urls.this
  id = "pki/config/urls"
}