From 8ec98bf1da9c191410bf5a127d6c9d0d6f49b554 Mon Sep 17 00:00:00 2001
From: Maximilian Schlenz <maximilian.schlenz@stackit.cloud>
Date: Mon, 14 Jul 2025 13:46:06 +0200
Subject: [PATCH] fix for new structure with nested resources inside project

---
 postgres/main.tf      |  2 +-
 postgres/variables.tf | 34 ++++++++++++++++++++++++++++++++--
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/postgres/main.tf b/postgres/main.tf
index 0507717..75f628d 100644
--- a/postgres/main.tf
+++ b/postgres/main.tf
@@ -18,7 +18,7 @@ resource "stackit_postgresflex_user" "user" {
   count = local.user_count
 
   project_id  = var.project_id
-  instance_id = stackit_postgresflex_instance.this.instance_id
+  instance_id = var.instance_id != "" ? var.instance_id : stackit_postgresflex_instance.this.instance_id
   username    = var.users[count.index].username
   roles       = var.users[count.index].roles
 }
diff --git a/postgres/variables.tf b/postgres/variables.tf
index dbe1920..061dd3f 100644
--- a/postgres/variables.tf
+++ b/postgres/variables.tf
@@ -4,6 +4,21 @@ variable "project_id" {
 
 variable "name" {
   type = string
+
+  validation {
+    condition     = length(regexall("^[a-z]([-a-z0-9]*[a-z0-9])?$", var.name)) > 0
+    error_message = <<EOT
+      The name must be a valid DNS-1035 label:
+      - only lower-case letters, digits or '-'
+      - must start with a letter
+      - must end with a letter or digit
+      EOT
+  }
+}
+
+variable "instance_id" {
+  type    = string
+  default = ""
 }
 
 variable "ver" {
@@ -38,19 +53,34 @@ variable "backup_schedule" {
 }
 
 variable "users" {
-  description = "List of users"
   type = list(object({
     username = string
     roles    = set(string)
   }))
   default = []
+  validation {
+    condition     = alltrue([
+      for user in var.users : user.username != "admin"
+    ])
+    error_message = "The username 'admin' is reserved and cannot be used."
+  }
 }
 
 variable "databases" {
-  description = "List of databases"
   type = list(object({
     name  = string
     owner = string
   }))
   default = []
+    validation {
+    condition = alltrue([
+      for db in var.databases : length(regexall("^[a-z]([-a-z0-9]*[a-z0-9])?$", db.name)) > 0
+    ])
+    error_message = <<EOT
+      The name must be a valid DNS-1035 label:
+      - only lower-case letters, digits or '-'
+      - must start with a letter
+      - must end with a letter or digit
+      EOT
+  }
 }