The ataila/ataila provider

# A customer, with its primary tenant and GitLab group created alongside.
resource "ataila_customer" "example" {
  short_name            = "EXAMPLE"
  long_name             = "Example Holdings Ltd"
  gitlab_group          = "example"
  primary_contact_email = "it@example.com"
  primary_contact_name  = "Example IT Desk"

  # Optional. Omit customer_index and the platform allocates the next free one.
  edition      = "sp"
  billing_tier = "PAYING"
  notes        = "Managed with OpenTofu / Terraform."
}

output "primary_tenant_id" {
  value = ataila_customer.example.primary_tenant_id
}

resource "ataila_tenant" "builds" {
  customer_id = ataila_customer.example.id
  slug        = "example-builds"
  name        = "Build Farm"
  description = "CI runners and build caches."
}

variable "developer_user_id" {
  description = "Id of a platform user, as the portal shows it."
  type        = string
}

resource "ataila_tenant_membership" "developer" {
  tenant_id = ataila_tenant.builds.id
  user_id   = var.developer_user_id
  role      = "member"
}

# A person. No password is sent or returned: they sign in after a password
# reset in the portal or a self-service reset.
resource "ataila_user" "dana" {
  email            = "dana.example@example.com"
  first_name       = "Dana"
  last_name        = "Example"
  locale           = "en"
  needs_git_access = true
}

output "dana_username" {
  value = ataila_user.dana.username
}

# One role for one person. The token applying this must itself carry the role.
resource "ataila_user_role_grant" "dana_reads_users" {
  user_id = ataila_user.dana.id
  role    = "users-read-global"
}

# A project record. Creating it provisions nothing: it stays "planned" until
# an ataila_project_provisioning runs.
resource "ataila_project" "shop" {
  tenant_id        = ataila_tenant.builds.id
  short_name       = "shop"
  gitlab_repo_slug = "shop-app"
  primary_domain   = "shop.example.com"
  long_name        = "Example Shop"

  # Settings left out get the platform's default at create.
  frontend_variant = "vue"
  enable_ai        = true
}

output "shop_frontend_url" {
  value = ataila_project.shop.urls.frontend
}

# Provisions the project and waits until every stage is done. After a change
# of the project leaves stages stale, the next plan shows an in-place update
# here, and applying it re-applies just those stages.
resource "ataila_project_provisioning" "shop" {
  project_id = ataila_project.shop.id

  timeouts {
    create = "90m"
    update = "30m"
  }
}

output "shop_provisioned" {
  value = ataila_project_provisioning.shop.provisioned
}

variable "developer_user_id" {
  description = "Id of a platform user who is a member of one of the customer's tenants."
  type        = string
}

resource "ataila_project_member" "developer" {
  project_id  = ataila_project.shop.id
  user_id     = var.developer_user_id
  role        = "developer"
  gitlab_role = "developer" # recorded, not enforced yet
}

# DEV deploys a named build.
resource "ataila_release_promotion" "api_dev" {
  project_id = ataila_project.shop.id
  component  = "app-api"
  target_env = "dev"
  version    = "1.4.0"
}

# UAT takes the version DEV last reported.
resource "ataila_release_promotion" "api_uat" {
  project_id = ataila_project.shop.id
  component  = "app-api"
  target_env = "uat"

  depends_on = [ataila_release_promotion.api_dev]
}

# PROD is a request a person approves in the portal; wait for the decision.
resource "ataila_release_promotion" "api_prod" {
  project_id        = ataila_project.shop.id
  component         = "app-api"
  target_env        = "prod"
  wait_for_approval = true

  timeouts {
    create = "4h"
  }

  depends_on = [ataila_release_promotion.api_uat]
}

resource "ataila_project_prod_lock" "shop" {
  project_id = ataila_project.shop.id
  locked     = true
}

# To unlock:
#   locked         = false
#   confirm_unlock = "shop"   # the project's short name

# A virtual key for one tenant's chatbot. Needs a platform with an AI gateway.
resource "ataila_ai_gateway_key" "chatbot" {
  organization_id = ataila_customer.example.primary_tenant_id
  env             = "prod"
  app             = "chatbot"
  models          = ["general", "code"]
  rpm_limit       = 120
  soft_budget_usd = 50
  budget_duration = "30d"

  # Return the value once, into the sensitive `secret` attribute. It is in
  # the platform's secrets store at `secret_path` either way.
  expose_secret = true

  # Change this to rotate the key.
  rotation_trigger = {
    at = "2026-10"
  }
}

output "chatbot_key" {
  value     = ataila_ai_gateway_key.chatbot.secret
  sensitive = true
}

# Pin the "code" tier to one served model. Destroying this only forgets it.
resource "ataila_ai_serving_tier" "code" {
  key          = "code"
  pinned_model = "model-code-large"
  enabled      = true
}

# A catalogue row: the weights are pulled in the portal, not here.
resource "ataila_ai_model" "coder" {
  repo          = "example-lab/example-coder-32B"
  vendor        = "Example Lab"
  license       = "apache-2.0"
  param_count_b = 32
  category      = "code"
  notes         = "Candidate for the code tier."
}

# Copies the weights from the central store to the node's local disk.
resource "ataila_ai_model_node_cache" "coder_on_ai_a" {
  model_id = ataila_ai_model.coder.id
  node     = "ai-a"

  timeouts {
    create = "6h"
  }
}

# The bundle issued for this platform, kept next to the configuration.
resource "ataila_licence_bundle" "this" {
  bundle = trimspace(file("${path.module}/licence.acplic1"))
}

output "licence_state" {
  value = ataila_licence_bundle.this.state
}

# Everything uploaded is readable without signing in: upload only public files.
resource "ataila_brand_asset" "logo" {
  kind   = "logo"
  source = "${path.module}/brand/logo.png"
}

resource "ataila_brand_asset" "favicon" {
  kind   = "favicon"
  source = "${path.module}/brand/favicon.ico"
}

resource "ataila_brand" "this" {
  product_name        = "Example Cloud"
  product_name_accent = "Cloud"
  brand_color         = "#1e88e5"
  page_title          = "Example Cloud portal"
  logo_size           = "medium"
  logo_asset_id       = ataila_brand_asset.logo.id
}