Terraform Provider

resource "onyx_llm_provider" "openai" {
  name          = "openai"
  provider_type = "openai"

  # Write-only: the key never reaches the state file. See below.
  api_key_wo         = var.openai_api_key
  api_key_wo_version = 1

  # The complete set of enabled models: anything omitted is removed on apply.
  model_configurations = [
    { name = "gpt-5" },
    { name = "gpt-5-mini" },
  ]
}

# Referencing the provider id also orders destroys correctly: the default is
# released before the provider holding it is deleted.
resource "onyx_llm_provider_default" "this" {
  provider_id = onyx_llm_provider.openai.id
  model_name  = "gpt-5"
}

# The web connector reads public pages, so its credential holds no secret.
resource "onyx_credential" "web" {
  source          = "web"
  name            = "public-web"
  credential_json = jsonencode({})
}

resource "onyx_connector" "docs" {
  name       = "docs-site"
  source     = "web"
  input_type = "load_state"

  # Re-index once a day.
  refresh_freq = 24 * 60 * 60

  connector_specific_config = jsonencode({
    base_url           = var.docs_base_url
    web_connector_type = "recursive"
  })
}

# The pair is the object that indexes. It also carries the access control for
# the documents it produces.
resource "onyx_cc_pair" "docs" {
  name          = "docs-site"
  connector_id  = onyx_connector.docs.id
  credential_id = onyx_credential.web.id
  access_type   = "public"
}

resource "onyx_document_set" "docs" {
  name        = "docs"
  description = "Public product documentation"
  cc_pair_ids = [onyx_cc_pair.docs.id]
}

resource "onyx_persona" "docs" {
  name        = "Docs"
  description = "Answers product questions from the documentation"

  system_prompt = <<-EOT
    You answer questions from the product documentation.
    If the documentation does not cover the question, say so.
  EOT

  document_set_ids = [onyx_document_set.docs.id]
}

resource "onyx_llm_provider" "openai" {
  name          = "openai"
  provider_type = "openai"

  api_key_wo         = var.openai_api_key
  api_key_wo_version = 2 # was 1 — bump after rotating the key

  model_configurations = [{ name = "gpt-5-mini" }]
}