locals {
  zabbix_dashboard_domain = "monitoring-dashboard.delphiplatform.io"
}

data "aws_iam_policy_document" "l2_support_dashboard_ses_sender_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "ses:FromAddress"
      values   = ["no-reply@mail.delphiplatform.io"]
    }
  }
}

resource "aws_iam_policy" "l2_support_dashboard_ses_sender_policy" {
  name   = "${local.name_prefix}-l2-support-ses_policy"
  policy = data.aws_iam_policy_document.l2_support_dashboard_ses_sender_policy_document.json
}

module "l2_support_s3_notifications_ro" {
  source = "../../../modules/iam/policies/s3/buckets_ro"

  bucket_masks = [module.s3_notifications.bucket.id]
  name         = "l2-support-s3-ro_policy"
  name_prefix  = local.name_prefix
}

data "aws_iam_policy_document" "l2_logs_access" {
  statement {
    effect    = "Allow"
    actions   = ["logs:GetLogEvents"]
    resources = ["arn:aws:logs:${var.aws_region_id}:${local.account_id}:log-group:/aws/lambda/${local.env_prefix}-delphi-slz-gdpr-email-sender-${local.env_prefix}:*"]
  }
}

resource "aws_iam_policy" "l2_logs_access" {
  name   = "${local.name_prefix}-l2-logs-access"
  policy = data.aws_iam_policy_document.l2_logs_access.json
}

module "l2_support_dashboard_role" {
  source = "../../../modules/iam/roles/ec2_instance_role"

  name_prefix = local.name_prefix
  name        = "l2-dashboard-role"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "ETL",
      service                  = "EC2",
      plat_env_project_service = "${local.aggregated_tag}_ETL_EC2",
      ticket                   = "SYS-21647"
    }
  )

  policies_list = [
    aws_iam_policy.l2_support_dashboard_ses_sender_policy.arn,
    "arn:aws:iam::aws:policy/AWSStepFunctionsReadOnlyAccess",
    module.l2_support_s3_notifications_ro.policy.arn,
    module.logging_policy.policy.arn,
    aws_iam_policy.l2_logs_access.arn,
  ]
}

module "l2_support_dashboard_instance" {
  source = "../../../modules/ec2/ec2"

  name_prefix            = "${local.name_prefix}-l2-dashboard-01"
  instances_count        = 1
  ami                    = "ami-01bc990364452ab3e"
  instance_type          = "t3.medium"
  use_public_ip          = false
  key_name               = "l2-support"
  termination_protection = true
  iam_instance_profile   = module.l2_support_dashboard_role.profile.name
  security_groups = [
    module.main_sg_map.management_id,
    module.main_sg_map.batch_id,
    module.main_sg_map.int_http_debug_id,
    module.main_sg_map.int_https_debug_id,
    module.main_sg_map.zabbix_id,
  ]
  subnet_ids       = [module.main_private_subnets.subnet_ids[0]]
  root_volume_size = 30
  root_volume_type = "gp3"
  encrypted        = true
  kms_key_id       = data.aws_kms_alias.default_ebs.target_key_arn

  enable_alarm = true
  alarm_name   = "${local.name_prefix}-l2-dashboard-status-check-failed-any"

  common_tags = merge(
    local.common_tags,
    {
      project                  = "ETL",
      service                  = "EC2",
      plat_env_project_service = "${local.aggregated_tag}_ETL_EC2",
      os_platform              = "linux",
      os_distribution          = "amazon",
      splunk                   = "true",
      role                     = "zabbix",
      ticket                   = "SYS-21647"
    }
  )
}

module "l2_support_dashboard_tg" {
  source = "../../../modules/ec2/tg"

  name_prefix = local.name_prefix
  common_tags = local.common_tags

  tg_name    = "l2-dashboard"
  tg_vpc_id  = module.main_vpc.vpc_id
  tg_targets = tolist(module.l2_support_dashboard_instance.ec2.*.id)

  tg_health_check_path                = "/"
  tg_health_check_healthy_threshold   = 2
  tg_health_check_unhealthy_threshold = 5
  tg_health_check_timeout             = 15
}

resource "aws_alb_listener_rule" "win_ws" {
  listener_arn = module.internal_alb_listener_https.alb_listener.arn

  action {
    type             = "forward"
    target_group_arn = module.l2_support_dashboard_tg.tg.arn
  }

  condition {
    host_header {
      values = [local.zabbix_dashboard_domain]
    }
  }
}

data "aws_route53_zone" "delphiplatform_zone" {
  provider     = aws.gdb-delphi-dev
  name         = "delphiplatform.io."
  private_zone = false
}

resource "aws_route53_record" "l2_support_dashboard_record" {
  zone_id = data.aws_route53_zone.delphiplatform_zone.zone_id
  name    = local.zabbix_dashboard_domain
  type    = "A"

  alias {
    name                   = module.internal_alb.alb_dns_name
    zone_id                = module.internal_alb.alb_zone_id
    evaluate_target_health = false
  }

  provider = aws.gdb-delphi-dev
}