locals {
  apollo_admin_panel_secrets_list = [
    "AUTH0_CLIENT_SECRET",
    "SECRET_KEY",
    "SENTRY_DSN",
  ]

  apollo_admin_panel_common_secrets = {
    MYSQL_DB_USER = aws_secretsmanager_secret.apollo_api_secret["MYSQL_DB_USER"]
    MYSQL_DB_PASS = aws_secretsmanager_secret.apollo_api_secret["MYSQL_DB_PASS"]
  }

  apollo_admin_panel_secrets_mapping = [
    for k, v in merge(aws_secretsmanager_secret.apollo_admin_panel_secret, local.apollo_admin_panel_common_secrets) :
    {
      name      = k,
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
    }
  ]

  apollo_admin_panel_env_vars = [
    {
      name  = "FLASK_ENV",
      value = local.environment
    },
    {
      name  = "MYSQL_DB_NAME",
      value = "dbSony_dbo"
    },
    {
      name  = "MYSQL_DB_HOST",
      value = module.domains.prod["main-db-rw"]
    },
    {
      name  = "MYSQL_DB_CHARSET",
      value = "utf8mb4"
    },
    {
      name  = "REDIS_HOST",
      value = data.aws_elasticache_cluster.main.cache_nodes.0.address
    },
    {
      name = "REDIS_HOSTS",
      value = jsonencode({
        prod = data.aws_elasticache_cluster.main.cache_nodes.0.address
      })
    },
    {
      name  = "ENABLE_REDIS_CLI",
      value = "True"
    },
    {
      name  = "AUTH0_DOMAIN",
      value = "accounts.apollo.stream"
    },
    {
      name  = "AUTH0_CALLBACK_URL",
      value = "https://${module.domains[local.env_prefix]["admin-cms"]}/callback"
    },
    {
      name  = "AUTH0_AUDIENCE",
      value = "https://private-api/"
    },
    {
      name  = "REDIS_ENV_PREFIXES_LIST",
      value = "apollo_api"
    },
    {
      name  = "AWS_S3_BUCKET_NAME",
      value = "${local.name_prefix}-admin-panel-assets"
    },
    {
      name  = "USER_ACCESS_PERMISSION",
      value = "access:cms-user"
    },
    {
      name  = "SUPERUSER_ACCESS_PERMISSION",
      value = "access:cms-superuser"
    },
    {
      name  = "AUTH0_USER_PAYLOAD_KEY",
      value = "http://private-api/user"
    },
    {
      name  = "AUTH0_CLIENT_ID",
      value = "WsS5bBqD30Wt58ehMe54xcEH5Na5lZVE"
    },
  ]
}

data "aws_ecr_repository" "apollo_admin_panel_ecr" {
  name     = "apollo-admin-panel"
  provider = aws.gdb-apollo-dev
}

data "aws_iam_policy" "admin_panel_assets_s3_rw_policy" {
  arn = "${local.policy_base_arn}-admin_panel_assets_rw"
}

resource "aws_secretsmanager_secret" "apollo_admin_panel_secret" {
  for_each = toset(local.apollo_admin_panel_secrets_list)

  name       = "${local.secrets_name_prefix}/admin-panel/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "apollo_admin_panel_ecs_role" {
  source      = "../../../modules/iam/roles/ecs_task_role"
  name        = "admin_panel_role"
  name_prefix = local.name_prefix

  policies_list = [
    data.aws_iam_policy.secrets_services_ro.arn,
    data.aws_iam_policy.logging_policy.arn,
    data.aws_iam_policy.admin_panel_assets_s3_rw_policy.arn,
  ]
}

module "apollo_admin_panel" {
  source = "../../../modules/ecs/services/webservice"

  env_prefix         = local.env_prefix
  project_group      = local.project_group
  region             = var.aws_region_id
  vpc_id             = data.aws_vpc.main.id
  cluster_arn        = data.aws_ecs_cluster.main.arn
  security_groups    = [data.aws_security_group.main.id]
  https_listener_arn = data.aws_lb_listener.protected_https_listener.arn
  task_exec_role_arn = data.aws_iam_role.standard_exec.arn

  # Networking parameters. Preferably use private subnets for containers
  is_public = false
  subnets   = data.aws_subnets.private_subnets.ids

  # Parameters that should be customized for each service
  project                 = "admin-panel"
  task_role_arn           = module.apollo_admin_panel_ecs_role.role.arn
  url                     = module.domains[local.env_prefix]["admin-cms"]
  tg_health_check_path    = "/health"
  tg_health_check_matcher = "200"
  container_port          = 8000
  cpu                     = 1024
  memory                  = 2048
  task_count              = 1
  secrets                 = jsonencode(local.apollo_admin_panel_secrets_mapping)
  env_vars                = local.apollo_admin_panel_env_vars
  image                   = "${data.aws_ecr_repository.apollo_admin_panel_ecr.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

resource "aws_route53_record" "apollo_admin_panel_record" {
  zone_id = data.aws_route53_zone.apollo_stream_zone.zone_id
  name    = module.domains[local.env_prefix]["admin-cms"]
  type    = "A"

  alias {
    name                   = data.aws_lb.protected_alb.dns_name
    zone_id                = data.aws_lb.protected_alb.zone_id
    evaluate_target_health = false
  }

  provider = aws.gdb-delphi-dev
}