terraform/datacrunch: Use pathexpand() for credentials file path

The datacrunch_api_key_file variable default uses tilde which
Terraform does not automatically expand in string defaults. While the
Python extraction script handles this via os.path.expanduser(), it is
better practice to make the expansion explicit at the Terraform level.

Apply pathexpand() when passing the path to the external data source
so the behavior is clear and self-documenting. Add a comment
explaining that tilde paths are supported.

Generated-by: Claude AI
Signed-off-by: Chuck Lever <[email protected]>

Author: chucklever

terraform/datacrunch/provider.tf

@@ -13,8 +13,10 @@ terraform {
 }
 
 # Extract OAuth2 credentials from credentials file
+# Use pathexpand() to properly handle tilde (~) in paths since
+# Terraform doesn't expand tilde in string variable defaults
 data "external" "datacrunch_credentials" {
-  program = ["python3", "${path.module}/extract_api_key.py", var.datacrunch_api_key_file]
+  program = ["python3", "${path.module}/extract_api_key.py", pathexpand(var.datacrunch_api_key_file)]
 }
 
 provider "datacrunch" {

terraform/datacrunch/vars.tf

@@ -1,5 +1,5 @@
 variable "datacrunch_api_key_file" {
-  description = "Path to file containing DataCrunch API key (client secret)"
+  description = "Path to file containing DataCrunch API credentials. Tilde (~) paths are supported and expanded via pathexpand()."
   type        = string
   default     = "~/.datacrunch/credentials"
 }