locals {
  atlas_um_secrets_list = [
    "AMPLITUDE_API_KEY",
    "AUTH0_CLIENT_SECRET",
    "DNA_IDENTITY_PRIVATE_KEY",
    "DNA_IDENTITY_PUBLIC_KEY",
    "SENTRY_DSN",
    "SESSION_SECRET",
    "USM_CLIENT_SECRET",
    "CORE_NOTIFICATIONS_CLIENT_SECRET",
  ]

  atlas_um_secrets_mapping_list = [
    for k, v in aws_secretsmanager_secret.atlas_um_secret :
    {
      name      = k,
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
    }
  ]

  atlas_um_secrets_combined = concat(
    local.atlas_um_secrets_mapping_list,
    [
      {
        name      = "PGDB_PASS",
        valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:core/${local.env_prefix}/um/pg/user:password::"
      },
      {
        name      = "PGDB_USER",
        valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:core/${local.env_prefix}/um/pg/user:username::"
      },
      {
        name      = "PGDB_HOST",
        valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:core/${local.env_prefix}/um/pg/user:host::"
      },
    ]
  )

  atlas_um_env_vars = [
    {
      name  = "FLASK_ENV",
      value = local.environment
    },
    {
      name  = "AUTH0_DOMAIN",
      value = "sme-dna.auth0.com"
    },
    {
      name  = "USM_HOSTNAME",
      value = "uat-auth-console.sonymusic.com"
    },
    {
      name  = "USM_AUTHORIZE_PATH",
      value = "/oauth2/openid/v1/authorize"
    },
    {
      name  = "USM_TOKEN_PATH",
      value = "/oauth2/openid/v1/token"
    },
    {
      name  = "USM_LOGOUT_PATH",
      value = "/oauth2/openid/v1/logout"
    },
    {
      name  = "USM_GRAPH_PATH",
      value = "/graph/v1"
    },
    {
      name  = "PGDB_NAME",
      value = "um_${local.env_prefix}"
    },
    /*
    {
      name  = "CELERY_BROKER_URL",
      value = "rediss://${data.aws_elasticache_replication_group.um_celery.primary_endpoint_address}:${data.aws_elasticache_replication_group.um_celery.port}?ssl_cert_reqs=none"
    },
    {
      name  = "CELERY_RESULT_BACKEND",
      value = "rediss://${data.aws_elasticache_replication_group.um_celery.primary_endpoint_address}:${data.aws_elasticache_replication_group.um_celery.port}?ssl_cert_reqs=none"
    },
    */
    {
      name  = "STATIC_URL",
      value = "https://${module.domains[local.env_prefix]["atlas-um-static"]}"
    },
    {
      name  = "JSON_LOGS",
      value = 1
    },
    /*
    {
      name  = "REDIS_URL",
      value = "rediss://${data.aws_elasticache_replication_group.um_celery.primary_endpoint_address}:${data.aws_elasticache_replication_group.um_celery.port}/0?ssl_cert_reqs=none"
    },
    */
    {
      name  = "CORE_NOTIFICATIONS_HOST",
      value = module.domains[local.env_prefix]["notifications-api"]
    },
    {
      name  = "AUTH0_CLIENT_ID",
      value = "l1sI2hKEVD5WbuDb1bqoWRELUb7KRcIJ"
    },
    {
      name  = "USM_CLIENT_ID",
      value = "S3gjKnI0Um41aEd5UVdoa2htSlc"
    },
    {
      name  = "DEV_TOKEN_ENABLED",
      value = "1"
    },
    {
      name  = "API_DOCS_ENABLED",
      value = "1"
    },
    {
      name  = "NO_MFA_ENABLED",
      value = "1"
    },
    {
      name  = "EVENT_BUS_NAME",
      value = "${local.name_prefix}-atlas_um"
    },
    {
      name  = "JWT_TOKEN_KID",
      value = "1df13bdd-b656-4cbb-983c-668f36157984"
    },
    {
      name  = "M2M_AUTH_HOST",
      value = module.domains[local.env_prefix]["atlas-um"]
    },
    {
      name  = "CORE_NOTIFICATIONS_CLIENT_ID",
      value = "f3d41194-cdab-48ec-b717-23df36cfce74"
    },
    {
      name  = "CORE_NOTIFICATIONS_AUDIENCE",
      value = "atlasum|core_notifications"
    },
    {
      name  = "CORE_IMAGES_HOST",
      value = module.domains[local.env_prefix]["images-api"]
    },
    {
      name  = "DNA_BEARER_TOKEN_COOKIE_NAME",
      value = "dna_bearer_token_${local.env_prefix}"
    },
    {
      name  = "DNA_REFRESH_TOKEN_COOKIE_NAME",
      value = "dna_refresh_token_${local.env_prefix}"
    },
    {
      name  = "DOMAIN",
      value = module.domains[local.env_prefix]["atlas-um"]
    },
  ]

  atlas_um_env_vars_combined = concat(
    local.atlas_um_env_vars,
    [
      {
        name = "ORIGINS",
        value = join(",",
          [
            "https://${module.apollo_domains[local.env_prefix]["atlas-um-example"]}",
            "https://${module.domains[local.env_prefix]["atlas-um-example"]}",
            "https://${module.rti_domains["${local.env_prefix}_insights"]["atlas-um-example"]}",
            "https://${module.whitelist_domains[local.env_prefix]["atlas-um-example"]}",
          ]
        )
      },
      {
        name = "ALLOWED_HOSTS",
        value = join(",",
          [
            module.domains[local.env_prefix]["atlas-um"],
            module.apollo_domains[local.env_prefix]["atlas-auth-proxy"],
            module.rti_domains["${local.env_prefix}_insights"]["atlas-auth-proxy"],
            module.whitelist_domains[local.env_prefix]["atlas-auth-proxy"],
          ]
        )
      },
      {
        name  = "LOGIN_URL",
        value = "https://${module.domains[local.env_prefix]["atlas-um"]}/usm/login"
      },
      {
        name  = "LOGOUT_URL",
        value = "https://${module.domains[local.env_prefix]["atlas-um"]}/usm/logout"
      },
      {
        name  = "PUBLIC_KEY_URL",
        value = "https://${module.domains[local.env_prefix]["atlas-um-static"]}/pem/public.pem"
      },
      {
        name = "PROXY_DOMAINS",
        value = join(",",
          [
            module.apollo_domains[local.env_prefix]["atlas-auth-proxy"],
            module.rti_domains["${local.env_prefix}_insights"]["atlas-auth-proxy"],
          ]
        )
      }
    ]
  )

  celery_tasks = {
    celery_worker = {
      entrypoint      = ["/opt/venv/bin/celery", "-A", "atlas_um.celery_worker.celery", "worker", "--loglevel=info"]
      healthcheck_cmd = ["CMD-SHELL", "/opt/venv/bin/celery -A atlas_um.celery_worker.celery inspect ping"]
    },
    celery_beat = {
      entrypoint      = ["/opt/venv/bin/celery", "-A", "atlas_um.celery_worker.celery", "beat", "--loglevel=info"]
      healthcheck_cmd = ["CMD-SHELL", "/opt/venv/bin/celery -A atlas_um.celery_worker.celery inspect ping"]
    },
  }
}

data "aws_ecr_repository" "atlas_um" {
  name = "core/atlas-um"
}

data "aws_ecr_repository" "atlas_um_sqitch" {
  name = "core/atlas-um-sqitch"
}

module "atlas_um_ecs_role" {
  source = "../../../modules/iam/roles/ecs_task_role"

  enable_default_role = false
  name_prefix         = local.name_prefix
  name                = "atlas_um_ecs_role"

  policies_list = [
    data.aws_iam_policy.logging_policy.arn,
    data.aws_iam_policy.secrets_deployment_ro.arn,
    data.aws_iam_policy.event_bus_publisher_policy.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Portal",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_PRL_ECS"
    }
  )
}

resource "aws_secretsmanager_secret" "atlas_um_secret" {
  for_each = toset(local.atlas_um_secrets_list)

  name       = "${local.secrets_name_prefix}/atlas-um/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "atlas_um_one_time_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-atlas-um-one-time"
  container_name  = "atlas-um"
  container_image = "${data.aws_ecr_repository.atlas_um.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu             = 1024
  memory          = 2048

  awslogs_create_group = false
  awslogs_group_name   = "/ecs/${local.name_prefix}-atlas-um"

  task_role_arn = module.atlas_um_ecs_role.role.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.atlas_um_env_vars_combined
  secrets  = local.atlas_um_secrets_combined

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}

module "atlas_um_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-atlas-um"
  container_name  = "atlas-um"
  container_image = "${data.aws_ecr_repository.atlas_um.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu             = 1024
  memory          = 2048

  awslogs_retention = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  entrypoint       = ["/opt/venv/bin/ddtrace-run", "/opt/venv/bin/uwsgi", "--ini", "/etc/uwsgi/uwsgi.ini"]
  defender_enabled = true

  task_role_arn = module.atlas_um_ecs_role.role.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.atlas_um_env_vars_combined
  secrets  = local.atlas_um_secrets_combined

  datadog_enabled    = true
  dd_apm_enabled     = true
  dd_container_image = "public.ecr.aws/datadog/agent:latest"
  dd_awslogs_group   = aws_cloudwatch_log_group.datadog-agent.name

  dd_secrets = [
    {
      name      = "DD_API_KEY",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${local.secrets_name_prefix}/common/DD_API_KEY"
    }
  ]

  dd_env_vars = [
    {
      name  = "DD_APM_IGNORE_RESOURCES",
      value = "GET /health"
    },
    {
      name  = "DD_TAGS",
      value = "service:core-atlas-um application_family:atlas"
    },
  ]

  port_mappings = [
    {
      containerPort = 8000
      hostPort      = 8000
      protocol      = "tcp"
    }
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
      servicename              = "${local.project_group}-atlas-um"
    }
  )
}
/*
module "atlas_um_service" {
  source = "../../../modules/ecs/services/service_taskless_v2"

  env_prefix    = local.env_prefix
  project       = "atlas-um"
  project_group = local.project_group

  cluster_arn   = data.aws_ecs_cluster.main.arn
  desired_count = 0

  security_groups = [data.aws_security_group.ecs.id]
  subnets         = data.aws_subnets.private_subnets.ids
  vpc_id          = data.aws_vpc.main.id

  route53_zone_id = data.aws_route53_zone.default.zone_id
  alb_dns_name    = data.aws_lb.external_alb.dns_name
  alb_zone_id     = data.aws_lb.external_alb.zone_id

  task_definition_arn = module.atlas_um_task_def.arn

  alb_enabled             = true
  https_listener_arn      = data.aws_lb_listener.external_https_listener.arn
  tg_health_check_path    = "/health"
  tg_health_check_matcher = "200"
  container_port          = 8000
  url                     = module.domains[local.env_prefix]["atlas-um"]

  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
      servicename              = "${local.project_group}-atlas-um"
    }
  )
}
*/
module "atlas_um_sqitch_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-atlas_um_sqitch"
  container_name  = "atlas-um-sqitch"
  container_image = "${data.aws_ecr_repository.atlas_um_sqitch.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu             = 512
  memory          = 1024

  awslogs_retention = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  task_role_arn = data.aws_iam_role.standard_exec.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = [
    {
      name  = "PGDB_NAME",
      value = "um_${local.env_prefix}"
    },
  ]
  secrets = [
    {
      name      = "PGDB_PASS",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/core/${local.env_prefix}/um_owner:password::"
    },
    {
      name      = "PGDB_USER",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/core/${local.env_prefix}/um_owner:username::"
    },
    {
      name      = "PGDB_HOST",
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:maintenance/common/core/${local.env_prefix}/um_owner:host::"
    },
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}

resource "aws_cloudwatch_log_group" "atlas_um_celery_log_group" {
  name              = "/ecs/${local.name_prefix}-atlas-um-celery"
  retention_in_days = module.cloudwatch_logs_retention_by_env[local.env_prefix]
  tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "CloudWatch",
      plat_env_project_service = "${local.aggregated_tag}_UM_CW"
    }
  )
}

module "atlas_um_celery_task_def" {
  for_each = local.celery_tasks
  source   = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-${each.key}"
  container_name  = "atlas-um"
  container_image = "${data.aws_ecr_repository.atlas_um.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu             = 1024
  memory          = 2048

  awslogs_create_group = false
  awslogs_group_name   = aws_cloudwatch_log_group.atlas_um_celery_log_group.name

  entrypoint = each.value.entrypoint

  task_role_arn = module.atlas_um_ecs_role.role.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.atlas_um_env_vars
  secrets  = local.atlas_um_secrets_combined

  healthcheck = {
    command     = each.value.healthcheck_cmd
    retries     = 5
    timeout     = 30
    interval    = 60
    startPeriod = 300
  }

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}
/*
module "atlas_um_celery_service" {
  for_each = local.celery_tasks
  source   = "../../../modules/ecs/services/service_taskless_v2"

  env_prefix    = local.env_prefix
  project       = "atlas-um-${each.key}"
  project_group = local.project_group

  cluster_arn   = data.aws_ecs_cluster.main.arn
  desired_count = 0
  min_percent   = 0
  max_percent   = 100

  security_groups = [data.aws_security_group.ecs.id]
  subnets         = data.aws_subnets.private_subnets.ids
  vpc_id          = data.aws_vpc.main.id

  task_definition_arn = module.atlas_um_celery_task_def[each.key].arn

  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}
*/
module "atlas_um_celery_flower_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-celery_flower"
  container_name  = "atlas-um"
  container_image = "${data.aws_ecr_repository.atlas_um.repository_url}:${local.docker_image_env_tag[local.env_prefix]}"
  cpu             = 1024
  memory          = 2048

  awslogs_create_group = false
  awslogs_group_name   = aws_cloudwatch_log_group.atlas_um_celery_log_group.name

  entrypoint = ["/opt/venv/bin/celery", "-A", "atlas_um.celery_worker.celery", "flower", "--basic_auth=flower_usr:0rch1d$"]

  task_role_arn = module.atlas_um_ecs_role.role.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.atlas_um_env_vars
  secrets  = local.atlas_um_secrets_combined

  port_mappings = [
    {
      containerPort = 5555
      hostPort      = 5555
      protocol      = "tcp"
    }
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}
/*
module "atlas_um_celery_flower_service" {
  source = "../../../modules/ecs/services/service_taskless_v2"

  env_prefix    = local.env_prefix
  project       = "atlas-um-celery_flower"
  project_group = local.project_group

  cluster_arn   = data.aws_ecs_cluster.main.arn
  desired_count = 0

  security_groups = [data.aws_security_group.ecs.id]
  subnets         = data.aws_subnets.private_subnets.ids
  vpc_id          = data.aws_vpc.main.id

  route53_zone_id = data.aws_route53_zone.default.zone_id
  alb_dns_name    = data.aws_lb.external_alb.dns_name
  alb_zone_id     = data.aws_lb.external_alb.zone_id

  task_definition_arn = module.atlas_um_celery_flower_task_def.arn

  alb_enabled             = true
  https_listener_arn      = data.aws_lb_listener.external_https_listener.arn
  tg_health_check_path    = "/healthcheck"
  tg_health_check_matcher = "200"
  container_port          = 5555
  url                     = module.domains[local.env_prefix]["um-celery-flower"]
  container_name          = "atlas-um"

  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}
*/