# profiles::netbox::facts
#
# Seeds the credentials the `netbox` custom fact needs to read this node's
# IP/interface data from NetBox. Inert until $api_token is set: with no token
# the fact is confined off (unenrolled hosts no-op).
#
# NetBox is authoritative and static IPs never change, so the fact caches every
# successful response under $cache_dir forever and reuses it during a NetBox
# outage - an outage can never fail a puppet run.
class profiles::netbox::facts (
  Optional[Sensitive[String]] $api_token  = undef,
  Stdlib::HTTPSUrl            $url        = 'https://netbox.k8s.syd1.au.unkin.net',
  Stdlib::AbsolutePath        $token_file = '/etc/puppetlabs/netbox.token',
  Stdlib::AbsolutePath        $url_file   = '/etc/puppetlabs/netbox.url',
  Stdlib::AbsolutePath        $cache_dir  = '/var/cache/puppet-netbox',
) {

  if $api_token =~ Undef {
    notify { 'netbox-facts-inert':
      message  => 'profiles::netbox::facts: api_token unset; netbox fact disabled on this host.',
      loglevel => 'info',
    }
  } else {
    file { $token_file:
      ensure    => file,
      owner     => 'root',
      group     => 'root',
      mode      => '0600',
      show_diff => false,
      content   => Sensitive("${api_token.unwrap}\n"),
    }

    file { $url_file:
      ensure  => file,
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      content => "${url}\n",
    }

    file { $cache_dir:
      ensure => directory,
      owner  => 'root',
      group  => 'root',
      mode   => '0700',
    }
  }
}