# This should go into the setup of the vault server itself, as the vault server also needs stuff that depends on this.
{
  khscodes.infrastructure.vault-prometheus-sender = {
    # This is quite ugly, but should get the job done. Sadly I cannot reference the output from here.
    terranixBackendName = "\${ vault_mount.prometheus-mtls.path }";
  };
  khscodes.infrastructure.provisioning.post.modules = [
    (
      { config, ... }:
      {
        khscodes.vault.enable = true;
        khscodes.vault.mount.prometheus-mtls = {
          type = "pki";
          path = "prometheus-mtls";
          max_lease_ttl_seconds = 10 * 365 * 24 * 60 * 60;
          default_lease_ttl_seconds = 60 * 60;
        };
        khscodes.vault.pki_secret_backend_root_cert.prometheus-mtls = {
          backend = config.khscodes.vault.output.mount.prometheus-mtls.path;
          type = "internal";
          common_name = "prometheus.kaareskovgaard.net";
          issuer_name = "prometheus-mtls-root-ca";
        };
      }
    )
  ];
}
