#!/usr/bin/env bash
set -euo pipefail

LOCATION="germanywestcentral"
RG="rg-iac-tfstate"
SA="stiactfstate$(openssl rand -hex 4)"   # global eindeutig, 3-24 Zeichen
CONTAINER="tfstate"

az group create -n "$RG" -l "$LOCATION" -o none

az storage account create -n "$SA" -g "$RG" -l "$LOCATION" \
  --sku Standard_ZRS --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --allow-shared-key-access false -o none

az storage account blob-service-properties update \
  --account-name "$SA" -g "$RG" \
  --enable-versioning true \
  --enable-delete-retention true --delete-retention-days 30 -o none

SA_ID=$(az storage account show -n "$SA" -g "$RG" --query id -o tsv)
ME=$(az ad signed-in-user show --query id -o tsv)
az role assignment create --role "Storage Blob Data Contributor" \
  --assignee "$ME" --scope "$SA_ID" -o none

echo "Warte auf Propagierung der Rollenzuweisung ..."
sleep 60

az storage container create -n "$CONTAINER" \
  --account-name "$SA" --auth-mode login -o none

cat > "$(dirname "$0")/../backend.hcl" <<EOF
resource_group_name  = "$RG"
storage_account_name = "$SA"
container_name       = "$CONTAINER"
use_azuread_auth     = true
EOF

echo "Backend bereit: $SA"