betterstack.tf

// Better Stack credentials come from a connected `betterstack` datastore (aws-betterstack /
// gcp-betterstack), which owns the `ingesting_host` and stores the source token in the cloud's
// secret manager. The token is read at apply time and emitted through the `secrets` output so the
// app module injects it as a secret env var rather than a plain one.
data "ns_connection" "betterstack" {
  name     = "betterstack"
  contract = "datastore/*/betterstack"
}

locals {
  ingesting_host         = data.ns_connection.betterstack.outputs.ingesting_host
  source_token_secret_id = data.ns_connection.betterstack.outputs.source_token_secret_id

  // Tolerate a pasted URL: strip a leading scheme and trailing slash down to the bare host.
  betterstack_host = trimsuffix(trimprefix(trimprefix(local.ingesting_host, "https://"), "http://"), "/")

  // Detect the connected cloud from the secret identifier: an AWS Secrets Manager ARN
  // (`arn:aws:...`) vs a GCP Secret Manager id (`projects/*/secrets/*`).
  is_aws = startswith(local.source_token_secret_id, "arn:")
}

// --- AWS: read the source token from AWS Secrets Manager ---
data "aws_secretsmanager_secret_version" "source_token" {
  count     = local.is_aws ? 1 : 0
  secret_id = local.source_token_secret_id
}

// --- GCP: read the source token from Google Secret Manager ---
data "google_secret_manager_secret_version" "source_token" {
  count  = local.is_aws ? 0 : 1
  secret = local.source_token_secret_id
}

locals {
  // Plaintext source token, read from the secret manager of the connected cloud.
  source_token = (
    local.is_aws ? data.aws_secretsmanager_secret_version.source_token[0].secret_string :
    data.google_secret_manager_secret_version.source_token[0].secret_data
  )
}