module "main_alb" {
  source = "../../../modules/ec2/alb/alb_v2"

  name_prefix               = local.name_prefix
  alb_security_groups       = [module.main_sg_map.alb_id, module.main_sg_map.public_access_sg_id]
  alb_subnets               = module.main_public_subnets.subnet_ids
  access_logs_enabled       = true
  access_logs_bucket_name   = data.aws_s3_bucket.security_logs.bucket
  access_logs_bucket_prefix = "${local.name_prefix}-external-main"
  enable_ip_blocking        = true
  alb_idle_timeout          = 121

  common_tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "Load Balancing",
      plat_env_project_service = "${local.aggregated_tag}_API_LB"
    }
  )
}

module "main_alb_listener_http" {
  source                = "../../../modules/ec2/alb/listener"
  alb_arn               = module.main_alb.alb_arn
  alb_listener_protocol = "HTTP"
}

module "main_alb_listener_https" {
  source                  = "../../../modules/ec2/alb/listener"
  alb_arn                 = module.main_alb.alb_arn
  alb_listener_protocol   = "HTTPS"
  aws_acm_certificate_arn = aws_acm_certificate.wildcard_filtr_apollo_cert.arn
}

#resource "aws_alb_listener_rule" "filtr-admin-account-forward" {
#  listener_arn = module.main_alb_listener_http.alb_listener.arn
#
#  action {
#    type             = "forward"
#    target_group_arn = module.filtr_admin_accounts_tg.tg.arn
#  }
#
#  condition {
#    host_header {
#      values = ["adminaccountsapi.filtr.com"]
#    }
#  }
#}

module "main_private_alb" {
  source = "../../../modules/ec2/alb/alb_v2"

  name_prefix = local.name_prefix
  alb_suffix  = "-private"
  alb_security_groups = [
    module.main_sg_map.alb_id,
    module.main_sg_map.ext_web_sg_id,
    module.main_sg_map.auth0_id,
    module.main_sg_map.web_debug_id_443,
  ]
  alb_subnets               = module.main_public_subnets.subnet_ids
  access_logs_enabled       = true
  access_logs_bucket_name   = data.aws_s3_bucket.security_logs.bucket
  access_logs_bucket_prefix = "${local.name_prefix}-private-main"
  enable_ip_blocking        = true
  alb_idle_timeout          = 121

  common_tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "Load Balancing",
      plat_env_project_service = "${local.aggregated_tag}_API_LB"
    }
  )
}

module "main_private_alb_listener_http" {
  source                = "../../../modules/ec2/alb/listener"
  alb_arn               = module.main_private_alb.alb_arn
  alb_listener_protocol = "HTTP"
}

module "main_private_alb_listener_https" {
  source                  = "../../../modules/ec2/alb/listener"
  alb_arn                 = module.main_private_alb.alb_arn
  alb_listener_protocol   = "HTTPS"
  aws_acm_certificate_arn = aws_acm_certificate.wildcard_filtr_apollo_cert.arn
}

module "internal_alb" {
  source = "../../../modules/ec2/alb/alb_v2"

  name_prefix = local.name_prefix
  alb_security_groups = [
    module.main_sg_map.alb_id,
    module.main_sg_map.vpn_http_id,
    module.main_sg_map.ext_web_sg_id,
    module.main_sg_map.web_debug_id_443,
  ]
  alb_internal              = true
  alb_subnets               = module.main_private_subnets.subnet_ids
  access_logs_enabled       = true
  access_logs_bucket_name   = data.aws_s3_bucket.security_logs.bucket
  access_logs_bucket_prefix = "${local.name_prefix}-internal-main"
  alb_idle_timeout          = 121

  common_tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "Load Balancing",
      plat_env_project_service = "${local.aggregated_tag}_API_LB"
    }
  )
}

module "internal_alb_listener_http" {
  source                = "../../../modules/ec2/alb/listener"
  alb_arn               = module.internal_alb.alb_arn
  alb_listener_protocol = "HTTP"
}

module "internal_alb_listener_https" {
  source                  = "../../../modules/ec2/alb/listener"
  alb_arn                 = module.internal_alb.alb_arn
  alb_listener_protocol   = "HTTPS"
  aws_acm_certificate_arn = aws_acm_certificate.wildcard_filtr_apollo_cert.arn
  alb_listener_ssl_policy = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"
}