main.tf

resource "azurerm_oracle_autonomous_database" "this" {
  name                = var.name
  resource_group_name = var.resource_group_name
  location            = var.location
  display_name        = var.display_name

  # --- Network posture. Exactly one of these three shapes is reachable; variables.tf enforces the choice. ---
  #   private        -> subnet_id + virtual_network_id set, allowed_ips absent
  #   public + ACL   -> allowed_ips non-empty
  #   public, no ACL -> allowed_ips = [], which the provider treats as "any IP" and cannot be undone
  subnet_id          = var.subnet_id
  virtual_network_id = var.virtual_network_id
  allowed_ips        = var.public_access_from_any_ip_enabled ? [] : var.allowed_ips

  mtls_connection_required = var.mtls_connection_required

  admin_password = var.admin_password

  compute_model                    = var.compute_model
  compute_count                    = var.compute_count
  data_storage_size_in_tbs         = var.data_storage_size_in_tbs
  auto_scaling_enabled             = var.auto_scaling_enabled
  auto_scaling_for_storage_enabled = var.auto_scaling_for_storage_enabled
  license_model                    = var.license_model

  db_workload            = var.db_workload
  db_version             = var.db_version
  character_set          = var.character_set
  national_character_set = var.national_character_set

  backup_retention_period_in_days = var.backup_retention_period_in_days

  customer_contacts = length(var.customer_contacts) == 0 ? null : var.customer_contacts

  dynamic "long_term_backup_schedule" {
    for_each = var.long_term_backup_schedule == null ? [] : [var.long_term_backup_schedule]

    content {
      enabled                  = long_term_backup_schedule.value.enabled
      repeat_cadence           = long_term_backup_schedule.value.repeat_cadence
      time_of_backup           = long_term_backup_schedule.value.time_of_backup
      retention_period_in_days = long_term_backup_schedule.value.retention_period_in_days
    }
  }

  tags = var.tags

  dynamic "timeouts" {
    for_each = var.timeouts == null ? [] : [var.timeouts]

    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------------------------------------------------
# Owned children — user-initiated backups of the keystone database.
#
# Genuine children: each takes the keystone's id and nothing else identifying, so a backup cannot exist without the
# database. Keyed by a stable identifier so adding one never re-indexes the rest.
# ---------------------------------------------------------------------------------------------------------------------

resource "azurerm_oracle_autonomous_database_backup" "this" {
  for_each = var.backups

  autonomous_database_id   = azurerm_oracle_autonomous_database.this.id
  name                     = try(each.value.name, null) == null ? each.key : each.value.name
  retention_period_in_days = each.value.retention_period_in_days
  type                     = try(each.value.type, null)

  dynamic "timeouts" {
    for_each = var.timeouts == null ? [] : [var.timeouts]

    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}