resource "random_password" "password" {
  length           = 16
  special          = true
  override_special = "!#$%&*-_=+[]{}<>:?"
}
/*
resource "aws_db_subnet_group" "main" {
  name       = "${local.name_prefix}-db-private-subnet-group"
  subnet_ids = module.main_private_subnets.subnet_ids
  tags       = local.common_tags
}
*/
resource "aws_db_parameter_group" "main_11" {
  name   = "${local.name_prefix}-parameter-group"
  family = "postgres11"

  # log all CREATE, ALTER, DROP queries
  parameter {
    name  = "log_statement"
    value = "ddl"
  }

  # log all ddl statements that run longer than 100 ms
  parameter {
    name  = "log_min_duration_statement"
    value = "100"
  }
}

resource "aws_db_parameter_group" "main_13" {
  name   = "${local.name_prefix}-parameter-group-13"
  family = "postgres13"

  # log all CREATE, ALTER, DROP queries
  parameter {
    name  = "log_statement"
    value = "ddl"
  }

  # log all ddl statements that run longer than 100 ms
  parameter {
    name  = "log_min_duration_statement"
    value = "100"
  }
}
/*
resource "aws_db_instance" "main" {
  storage_type                    = "gp2"
  instance_class                  = "db.t3.small"
  identifier                      = "${local.name_prefix}-um-instance"
  final_snapshot_identifier       = "${local.name_prefix}-um-instance-final"
  apply_immediately               = true
  db_subnet_group_name            = aws_db_subnet_group.main.id
  parameter_group_name            = aws_db_parameter_group.main_11.name
  option_group_name               = ""
  vpc_security_group_ids          = [module.main_sg_map.rds_id, module.main_sg_map.db_debug_id]
  publicly_accessible             = false
  copy_tags_to_snapshot           = true
  engine_version                  = "11.12"
  allocated_storage               = 20
  deletion_protection             = false
  backup_retention_period         = 7
  auto_minor_version_upgrade      = true
  enabled_cloudwatch_logs_exports = ["postgresql"]
  snapshot_identifier             = "arn:aws:rds:us-east-1:582412345909:snapshot:dev-core-um-instance-encrypted-20220202"
  storage_encrypted               = true
  kms_key_id                      = data.aws_kms_alias.default_rds.target_key_arn

  tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_RDS"
    }
  )

  lifecycle {
    ignore_changes = [password, snapshot_identifier, engine_version]
  }
}
*/
resource "aws_secretsmanager_secret" "um_db_cluster_admin" {
  name       = "maintenance/root/${local.secrets_name_prefix}/um_admin"
  kms_key_id = module.kms_secrets_manager.maintenance_root_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "um_db_database_owner" {
  name       = "maintenance/common/${local.secrets_name_prefix}/um_owner"
  kms_key_id = module.kms_secrets_manager.maintenance_common_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "um_db_database_user" {
  name       = "${local.secrets_name_prefix}/um/pg/user"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "um_db_database_reader" {
  name       = "${local.secrets_name_prefix}/um/pg/reader"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}
/*
resource "aws_db_instance" "core_images_db" {
  storage_type               = "gp2"
  instance_class             = "db.t3.small"
  identifier                 = "${local.name_prefix}-images"
  final_snapshot_identifier  = "${local.name_prefix}-images-final"
  apply_immediately          = true
  db_subnet_group_name       = aws_db_subnet_group.main.id
  parameter_group_name       = aws_db_parameter_group.main_13.name
  option_group_name          = ""
  vpc_security_group_ids     = [module.main_sg_map.rds_id, module.main_sg_map.db_debug_id]
  publicly_accessible        = false
  copy_tags_to_snapshot      = true
  password                   = random_password.password.result
  username                   = "images_admin"
  engine_version             = "13.4"
  allocated_storage          = 20
  engine                     = "postgres"
  deletion_protection        = false
  backup_retention_period    = 7
  auto_minor_version_upgrade = true
  storage_encrypted          = true
  kms_key_id                 = data.aws_kms_alias.default_rds.target_key_arn
  db_name                    = "images_${local.env_prefix}"

  enabled_cloudwatch_logs_exports = [
    "postgresql"
  ]

  tags = merge(
    local.common_tags,
    {
      project                  = "API",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_API_RDS"
    }
  )

  lifecycle {
    ignore_changes = [password, snapshot_identifier, engine_version]
  }
}
*/
resource "aws_secretsmanager_secret" "core_images_db_database_admin" {
  name       = "maintenance/root/${local.secrets_name_prefix}/images_admin"
  kms_key_id = module.kms_secrets_manager.maintenance_root_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_images_db_database_owner" {
  name       = "maintenance/common/${local.secrets_name_prefix}/images_owner"
  kms_key_id = module.kms_secrets_manager.maintenance_common_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_images_db_database_user" {
  name       = "${local.secrets_name_prefix}/images/pg/user"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_images_db_database_reader" {
  name       = "${local.secrets_name_prefix}/images/pg/reader"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_notifications_db_database_admin" {
  name       = "maintenance/root/${local.secrets_name_prefix}/notifications_admin"
  kms_key_id = module.kms_secrets_manager.maintenance_root_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_notifications_db_database_owner" {
  name       = "maintenance/common/${local.secrets_name_prefix}/notifications_owner"
  kms_key_id = module.kms_secrets_manager.maintenance_common_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_notifications_db_database_user" {
  name       = "${local.secrets_name_prefix}/notifications/pg/user"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

resource "aws_secretsmanager_secret" "core_notifications_db_database_reader" {
  name       = "${local.secrets_name_prefix}/notifications/pg/reader"
  kms_key_id = module.kms_secrets_manager.general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}