terraform {
  backend "s3" {
    bucket                  = "dev-dna-tfstate"
    key                     = "Apollo/Development/deploy.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/credentials"
    profile                 = "gdb-delphi-dev"
    dynamodb_table          = "terraform-state-lock-dynamodb"
  }
}

provider "aws" {
  profile                 = var.aws_profile
  region                  = var.aws_region_id

  default_tags {
    tags = {
      platform           = var.platform.name
      environment        = var.platform.environment
      platform_with_env  = "${var.platform.name} ${var.platform.environment}"
      managed_by         = "Terraform"
      application_family = "apollo"
    }
  }
}

provider "aws" {
  alias                   = "eu-west-1"
  profile                 = var.aws_profile
  region                  = "eu-west-1"

  default_tags {
    tags = {
      platform           = var.platform.name
      environment        = var.platform.environment
      platform_with_env  = "${var.platform.name} ${var.platform.environment}"
      managed_by         = "Terraform"
      application_family = "apollo"
    }
  }
}

provider "aws" {
  alias                   = "gdb-apollo-dev"
  profile                 = "gdb-apollo-dev"
  region                  = var.aws_region_id

  default_tags {
    tags = {
      platform           = var.platform.name
      environment        = var.platform.environment
      platform_with_env  = "${var.platform.name} ${var.platform.environment}"
      managed_by         = "Terraform"
      application_family = "apollo"
    }
  }
}

locals {
  env_prefix          = lower(var.platform.prefix)
  project_group       = lower(var.platform.name)
  name_prefix         = lower("${var.platform.prefix}-${var.platform.name}")
  account_id          = data.aws_caller_identity.current.account_id
  policy_base_arn     = "arn:aws:iam::${local.account_id}:policy/${local.name_prefix}"
  environment         = lower(var.platform["environment"])
  secrets_name_prefix = "${local.project_group}/${local.env_prefix}"
  ecr_prefix          = "${local.account_id}.dkr.ecr.${var.aws_region_id}.amazonaws.com"

  common_tags = {}
  aggregated_tag = "${var.platform.short_platform_name}_${upper(var.platform.prefix)}"

  docker_image_env_tag = {
    dev   = "develop",
    qa    = "qa",
    stage = "release",
    uat   = "uat",
    prod  = "master",
  }

  service_domains = {
    admin-api         = "${local.env_prefix}-adminapi.filtr.com"
    admin-api-proxy   = "${local.env_prefix}-admin-api-ext-internal.apollo.stream"
    admin-cms         = "${local.env_prefix}-cms.apollo.stream"
    apollo-api        = "${local.env_prefix}-apollo-api-internal.apollo.stream"
    apolloapp         = "${local.env_prefix}.apollo.stream"
    auth-api          = "${local.env_prefix}-auth-api-internal.apollo.stream"
    dsp-api           = "${local.env_prefix}-dsp-api-internal.apollo.stream"
    filtr-api         = "${local.env_prefix}-api.filtr.com"
    gate-api          = "${local.env_prefix}-gate-api-internal.apollo.stream"
    private-api       = "${local.env_prefix}-privateapi.filtr.com"
    traefik           = "${local.env_prefix}-proxy.apollo.stream"
    traefik-dashboard = "${local.env_prefix}-dashboard.apollo.stream"
    user-data-api     = "${local.env_prefix}-user-data-internal.apollo.stream"
    vendor-api        = "${local.env_prefix}-vendor-api-internal.apollo.stream"
  }
}

# The attribute `${data.aws_caller_identity.current.account_id}` will be current account number.
data "aws_caller_identity" "current" {}

data "aws_vpc" "main" {
  tags = {
    Name = "${local.env_prefix}-${local.project_group}-vpc"
  }
}

data "aws_subnets" "public_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.env_prefix}-${local.project_group}-subnet-public-0*"
  }
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.env_prefix}-${local.project_group}-subnet-private-0*"
  }
}

data "aws_security_group" "main" {
  tags = {
    Name = "${local.env_prefix}-${local.project_group}-sg-ecs"
  }
}

data "aws_iam_role" "standard_exec" {
  name = "${local.env_prefix}-${local.project_group}-ecs-task_execution_role"
}

data "aws_ecs_cluster" "main" {
  cluster_name = "${local.env_prefix}-${local.project_group}-clu"
}

data "aws_iam_policy" "secrets-services-ro" {
  arn = "${local.policy_base_arn}-secrets-services-ro"
}

data "aws_iam_policy" "logging_policy" {
  arn = "${local.policy_base_arn}-logging"
}

data "aws_iam_policy" "track_playlist_history_rw" {
  arn = "${local.policy_base_arn}-track_playlist_history_rw"
}

data "aws_iam_policy" "hot_hits_history_rw" {
  arn = "${local.policy_base_arn}-hot_hits_history_rw"
}

data "aws_s3_bucket" "logs" {
  bucket = "security-${local.account_id}-logs"
}

resource "aws_cloudwatch_log_group" "datadog-agent" {
  name = "/ecs/${local.name_prefix}-datadog-agent"
  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_ECS"
    }
  )
}

data "aws_iam_policy_document" "run_ecs_task" {
  statement {
    actions   = ["iam:PassRole"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "iam:PassedToService"
      values = [
        "ec2.amazonaws.com",
        "ecs-tasks.amazonaws.com"
      ]
    }
  }
  statement {
    actions   = ["ecs:RunTask"]
    effect    = "Allow"
    resources = ["arn:aws:ecs:*:${local.account_id}:task-definition/${local.name_prefix}*:*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
  statement {
    actions   = ["ecs:ListTasks"]
    effect    = "Allow"
    resources = ["*"]
    condition {
      test     = "ArnLike"
      variable = "ecs:cluster"
      values   = ["arn:aws:ecs:${var.aws_region_id}:${local.account_id}:cluster/${local.name_prefix}-clu"]
    }
  }
}

resource "aws_iam_policy" "run_ecs_task" {
  name        = "${local.name_prefix}-run_ecs_tasks"
  description = "Allows to run and list ECS tasks in ${local.name_prefix}-clu ECS cluster."
  policy      = data.aws_iam_policy_document.run_ecs_task.json
}

module "ecs_scheduler_role" {
  source      = "../../../modules/iam/roles/cloudwatch_role"
  name_prefix = local.name_prefix
  name        = "ecs_scheduler_role"
  common_tags = local.common_tags
  policies_list = [
    aws_iam_policy.run_ecs_task.arn
  ]
}

data "aws_kms_key" "secrets_general_key" {
  key_id = "alias/${local.env_prefix}/${local.project_group}/secrets_general"
}

data "aws_elasticache_cluster" "main" {
  cluster_id = "${local.name_prefix}-api"

  provider = aws.gdb-apollo-dev
}

module "domains" {
  source = "../../../modules/domains/apollo"
}