data "aws_secretsmanager_secret_version" "admin_api_auth_key" {
  secret_id = "${local.secrets_name_prefix}/common/ADMINAPI_KEY"
}

module "admin_api_nginx_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-admin-api-proxy"
  container_name  = "admin-api-proxy"
  container_image = "475275892927.dkr.ecr.us-east-1.amazonaws.com/infra/nginx-caching-proxy:1.21.0-dot-net-traefik"
  cpu             = 256
  memory          = 512

  awslogs_retention = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  healthcheck = {
    command     = ["CMD-SHELL", "curl -f http://localhost:8000/loadBalancerStatus.aspx || exit 1"]
    retries     = 3
    timeout     = 5
    interval    = 30
    startPeriod = 5
  }

  task_role_arn = data.aws_iam_role.standard_exec.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = [
    {
      name  = "DNS_SERVER"
      value = cidrhost(data.aws_vpc.main.cidr_block, 2)
    },
    {
      name  = "BACKEND_ADDRESS"
      value = module.domains[local.env_prefix]["admin-api"]
    },
    {
      name  = "HEALTH_CHECK_BACKEND_ADDRESS"
      value = module.domains[local.env_prefix]["filtr-api"]
    },
  ]

  port_mappings = [
    {
      containerPort = 8000
      hostPort      = 8000
      protocol      = "tcp"
    }
  ]

  docker_labels = {
    "traefik.enable" = "true"

    "traefik.http.services.admin-api-proxy.loadBalancer.server.port"          = "8000"
    "traefik.http.services.admin-api-proxy.loadBalancer.server.scheme"        = "http"
    "traefik.http.services.admin-api-proxy.loadBalancer.healthCheck.interval" = "30s"
    "traefik.http.services.admin-api-proxy.loadBalancer.healthCheck.path"     = "/loadBalancerStatus.aspx"
    "traefik.http.services.admin-api-proxy.loadBalancer.healthCheck.port"     = "8000"
    "traefik.http.services.admin-api-proxy.loadBalancer.healthCheck.scheme"   = "http"
    "traefik.http.services.admin-api-proxy.loadBalancer.healthCheck.timeout"  = "15s"

    // requests via traefik
    "traefik.http.routers.admin-api-proxy.rule"        = "Host(`${module.domains[local.env_prefix]["traefik"]}`, `${module.domains.test["traefik"]}`, `${module.domains.qa["traefik"]}`, `${module.domains.stage["traefik"]}`) && PathPrefix(`/{marketId:[0-9]+}`, `/node-proxy/export`, `/applemusic`, `/musicservices`, `/newmusicfriday`, `/spotifyanalytics`, `/spotifycharts`, `/allplaylists`, `/apiconsumers`, `/applemusic`, `/applemusicsearchhistory`, `/buzzuseraccount`, `/editorialplaylist`, `/globalization`, `/marketglobalization`, `/marketplaylists`, `/markets`, `/mostplaylistedtrack`, `/playlistcategoryicons`, `/playlistcuration`, `/playlistgraph`, `/playlistmarket`, `/playlists`, `/playlistsync`, `/playlisttrackgraph`, `/serviceaccounts`, `/sonyalbums`, `/sonytracks`, `/spotifyanalytics`, `/spotifybrowse`, `/spotifycharts`, `/spotifyplaylist`, `/spotifyplaylists`, `/spotifyplaylistsbyuser`, `/spotifyplaylistswithtrack`, `/spotifyregions`, `/spotifysearch`, `/spotifysearchhistory`, `/spotifyuser`, `/spotifyusercountries`, `/starredcontent`, `/stats`, `/tagcategories`, `/trackplaylistadds`, `/trends`, `/amazonsearch`, `/resurrectspotifyplaylist`)"
    "traefik.http.routers.admin-api-proxy.entryPoints" = "web"
    "traefik.http.routers.admin-api-proxy.service"     = "admin-api-proxy"
    "traefik.http.routers.admin-api-proxy.middlewares" = join(",", [
      "admin-api-proxy-cors@ecs",
      "admin-api-proxy-gzip@ecs",
      "admin-api-proxy-auth@ecs",
      "admin-api-proxy-addAuthHeader@ecs",
    ])

    "traefik.http.routers.admin-api-proxy-private-api.rule"        = "Host(`${module.domains[local.env_prefix]["private-api"]}`, `${module.domains.test["private-api"]}`, `${module.domains.qa["private-api"]}`, `${module.domains.stage["private-api"]}`) && PathPrefix(`/playlistgraph`, `/sonytracks`)"
    "traefik.http.routers.admin-api-proxy-private-api.entryPoints" = "web"
    "traefik.http.routers.admin-api-proxy-private-api.service"     = "admin-api-proxy"
    "traefik.http.routers.admin-api-proxy-private-api.middlewares" = join(",", [
      "admin-api-proxy-cors@ecs",
      "admin-api-proxy-gzip@ecs",
      "admin-api-proxy-auth@ecs",
      "admin-api-proxy-addAuthHeader@ecs",
    ])

    "traefik.http.middlewares.admin-api-proxy-auth.forwardAuth.address"             = "https://${module.domains[local.env_prefix]["auth-api"]}/authorize"
    "traefik.http.middlewares.admin-api-proxy-auth.forwardAuth.trustForwardHeader"  = "true"
    "traefik.http.middlewares.admin-api-proxy-auth.forwardAuth.authResponseHeaders" = "X-User-Id"

    "traefik.http.middlewares.admin-api-proxy-addAuthHeader.headers.customRequestHeaders.filtrauthentication" = data.aws_secretsmanager_secret_version.admin_api_auth_key.secret_string

    "traefik.http.middlewares.admin-api-proxy-cors.headers.accessControlAllowOriginList" = join(",", concat(formatlist("https://%s", [
      module.domains[local.env_prefix]["apolloapp"],
      module.domains.test["apolloapp"],
      module.domains.qa["apolloapp"],
      module.domains.stage["apolloapp"],
      module.domains.local["apolloapp"],
      ]), formatlist("http://%s", [
      module.domains.local["apolloapp"],
    ])))
    "traefik.http.middlewares.admin-api-proxy-cors.headers.accessControlMaxAge" = "600"
    "traefik.http.middlewares.admin-api-proxy-cors.headers.addVaryHeader"       = "true"

    "traefik.http.middlewares.admin-api-proxy-gzip.compress" = "true"

    // direct requests
    "traefik.http.routers.admin-api-proxy-internal.rule"        = "Host(`${module.domains[local.env_prefix]["admin-api-proxy"]}`)"
    "traefik.http.routers.admin-api-proxy-internal.entryPoints" = "web"
    "traefik.http.routers.admin-api-proxy-internal.service"     = "admin-api-proxy"
    "traefik.http.routers.admin-api-proxy-internal.middlewares" = "admin-api-proxy-gzip@ecs"
  }

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
      servicename              = "${local.project_group}-admin-api-proxy"
    }
  )
}

module "adminapi_nginx_service" {
  source = "../../../modules/ecs/services/service_taskless_v2"

  env_prefix    = local.env_prefix
  project       = "admin-api-proxy"
  project_group = local.project_group

  cluster_arn   = data.aws_ecs_cluster.common.arn
  desired_count = 1

  security_groups = [data.aws_security_group.main.id]
  subnets         = data.aws_subnets.private_subnets.ids
  vpc_id          = data.aws_vpc.main.id

  task_definition_arn = module.admin_api_nginx_task_def.arn

  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS",
      service_name             = "apollo-admin-api-proxy"
    }
  )
}