provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "apis" {
  for_each = toset([
    "aiplatform.googleapis.com",
    "storage.googleapis.com",
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "iam.googleapis.com",
    "run.googleapis.com",
    "artifactregistry.googleapis.com",
    "cloudbuild.googleapis.com",
    "cloudbuildv2.googleapis.com",
    "secretmanager.googleapis.com",
    "monitoring.googleapis.com",
    "logging.googleapis.com",
    "cloudtrace.googleapis.com",
    "pubsub.googleapis.com",
    "cloudfunctions.googleapis.com",
  ])
  service                    = each.key
  disable_dependent_services = true
}

resource "google_service_account" "agent_sa" {
  account_id   = "osvauco-agent-sa"
  display_name = "OSVauco Agent Runner SA"
}

resource "google_project_iam_member" "agent_sa_roles" {
  for_each = toset([
    "roles/aiplatform.user",
    "roles/storage.objectAdmin",
    "roles/logging.logWriter",
    "roles/cloudtrace.agent",
    "roles/monitoring.metricWriter",
    "roles/secretmanager.secretAccessor",
    "roles/run.invoker",
  ])
  project = var.project_id
  role    = each.key
  member  = "serviceAccount:${google_service_account.agent_sa.email}"
}

resource "google_pubsub_topic" "billing_alerts" {
  name = "billing-alert-auto-teardown"
}

resource "google_pubsub_subscription" "billing_alerts_sub" {
  name  = "billing-alert-subscription"
  topic = google_pubsub_topic.billing_alerts.name

  # Push to an email address
  push_config {
    push_endpoint = "mailto:${var.alert_email}"
  }
}