data "aws_kms_alias" "default_rds" {
  name = "alias/default_rds"
}

# DB part
resource "aws_db_subnet_group" "public" {
  name       = "${local.name_prefix}-public-db-subnet-group"
  subnet_ids = module.main_public_subnets.subnet_ids
  tags = merge(
    local.common_tags,
    {
      project                  = "SLZ Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_AURA"
    }
  )
}

resource "aws_db_subnet_group" "private" {
  name       = "${local.name_prefix}-private-db-subnet-group"
  subnet_ids = module.main_private_subnets.subnet_ids
  tags = merge(
    local.common_tags,
    {
      project                  = "SLZ Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_AURA"
    }
  )
}

# slz RDS proxy role
module "rds_proxy" {
  source      = "../../../modules/iam/roles/rds_role"
  name_prefix = local.name_prefix
  name        = "rds_proxy"
  common_tags = merge(
    local.common_tags,
    {
      project                  = "SLZD",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_AURA"
    }
  )
  policies_list = [
    module.kms_secrets_manager.secrets_services_ro_policy.arn
  ]
}

data "aws_secretsmanager_secret" "slz_proxy_users" {
  for_each = toset(var.slz_proxy_secrets)
  name     = "${lower(var.platform["name"])}/${local.env_prefix}/${each.value}"
}

module "slz_rds_standard_proxy" {
  source                       = "../../../modules/rds/proxy"
  name                         = "${local.name_prefix}-slz-standard"
  rds_proxy_role_arn           = module.rds_proxy.role.arn
  db_instance_id               = aws_db_instance.slz_instance.identifier
  vpc_subnet_ids               = module.main_private_subnets.subnet_ids
  max_connections_percent      = 85
  max_idle_connections_percent = 30
  vpc_security_group_ids = [
    module.main_sg_map.aurora_id,
    module.main_sg_map.db_debug_id
  ]
  creds_secrets = [for secret in data.aws_secretsmanager_secret.slz_proxy_users : secret.arn]
  tags = merge(
    local.common_tags,
    {
      project                  = "SLZ Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_AURA"
    }
  )
}

# RDS instances
# SLZ
resource "aws_db_parameter_group" "slz_17" {
  name   = "${local.name_prefix}-slz-parameter-group-17"
  family = "postgres17"
}

resource "aws_db_instance" "slz_instance" {
  allocated_storage           = 20
  max_allocated_storage       = 100
  storage_type                = "gp3"
  engine                      = "postgres"
  engine_version              = "17.7"
  allow_major_version_upgrade = true
  instance_class              = "db.t4g.medium"
  identifier                  = "${local.name_prefix}-slz"
  apply_immediately           = true
  db_subnet_group_name        = aws_db_subnet_group.private.id
  parameter_group_name        = aws_db_parameter_group.slz_17.name
  vpc_security_group_ids = [
    module.main_sg_map.aurora_id,
    module.main_sg_map.db_debug_id
  ]
  publicly_accessible                 = false
  snapshot_identifier                 = "qa-delphi-slz-kms"
  copy_tags_to_snapshot               = true
  backup_retention_period             = 7
  storage_encrypted                   = true
  kms_key_id                          = data.aws_kms_alias.default_rds.target_key_arn
  final_snapshot_identifier           = "${local.name_prefix}-slz-final-snapshot"
  iam_database_authentication_enabled = true

  lifecycle {
    ignore_changes = [password, allocated_storage, engine_version]
  }

  tags = merge(
    local.common_tags,
    {
      Name                     = "${local.name_prefix}-slz"
      project                  = "SLZ Data",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_SLZD_RDS"
    }
  )
}

# Main
resource "aws_rds_cluster_parameter_group" "main_db_13" {
  name   = "${local.name_prefix}-main-cluster-parameter-group-13"
  family = "aurora-postgresql13"

  parameter {
    name  = "work_mem"
    value = "65536"
  }

  parameter {
    name  = "maintenance_work_mem"
    value = "GREATEST({DBInstanceClassMemory/20822},65536)"
  }

  parameter {
    name  = "log_temp_files"
    value = -1 // "131072"
  }

  parameter {
    name  = "random_page_cost"
    value = "1.1"
  }

  parameter {
    name         = "shared_buffers"
    value        = "SUM({DBInstanceClassMemory/11000},-50003)"
    apply_method = "pending-reboot"
  }
}

resource "aws_db_parameter_group" "main_db_13" {
  name   = "${local.name_prefix}-main-db-parameter-group-13"
  family = "aurora-postgresql13"

  parameter {
    name         = "shared_buffers"
    value        = "SUM({DBInstanceClassMemory/11000},-50003)"
    apply_method = "pending-reboot"
  }
}

resource "aws_rds_cluster_parameter_group" "main_db_17" {
  name   = "${local.name_prefix}-main-cluster-parameter-group-17"
  family = "aurora-postgresql17"

  parameter {
    name  = "work_mem"
    value = "65536"
  }

  parameter {
    name  = "maintenance_work_mem"
    value = "GREATEST({DBInstanceClassMemory/20822},65536)"
  }

  parameter {
    name  = "log_temp_files"
    value = -1 // "131072"
  }

  parameter {
    name  = "random_page_cost"
    value = "1.1"
  }

  parameter {
    name         = "shared_buffers"
    value        = "SUM({DBInstanceClassMemory/11000},-50003)"
    apply_method = "pending-reboot"
  }
}

resource "aws_db_parameter_group" "main_db_17" {
  name   = "${local.name_prefix}-main-db-parameter-group-17"
  family = "aurora-postgresql17"

  parameter {
    name         = "shared_buffers"
    value        = "SUM({DBInstanceClassMemory/11000},-50003)"
    apply_method = "pending-reboot"
  }
}

module "main_aurora" {
  source                              = "../../../modules/rds/aurora_v2"
  name                                = "main"
  name_prefix                         = local.name_prefix
  vpc_id                              = module.main_vpc.vpc_id
  db_subnet_group_name                = aws_db_subnet_group.private.id
  security_groups                     = [module.main_sg_map.aurora_id, module.main_sg_map.db_debug_id]
  instance_type                       = "db.r6g.xlarge"
  engine                              = "aurora-postgresql"
  engine_version                      = "17.7"
  allow_major_version_upgrade         = true
  db_cluster_parameter_group_name     = aws_rds_cluster_parameter_group.main_db_17.name
  db_parameter_group_name             = aws_db_parameter_group.main_db_17.name
  publicly_accessible                 = false
  apply_immediately                   = true
  backup_retention_period             = 7
  snapshot_identifier                 = "qa-delphi-main-kms"
  performance_insights_enabled        = true
  monitoring_role_arn                 = "arn:aws:iam::${local.account_id}:role/rds-monitoring-role"
  monitoring_interval                 = "60"
  iam_database_authentication_enabled = true

  storage_encrypted = true
  kms_key_id        = data.aws_kms_alias.default_rds.target_key_arn

  iam_role_assosiations = {
    "s3Export" = module.rds_s3_export_role.role.arn,
    "s3Import" = module.rds_s3_import_role.role.arn,
  }
  common_tags = merge(
    local.common_tags,
    {
      project                  = "Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_DATA_AURA"
    }
  )
}

# Workflowdb
resource "aws_db_parameter_group" "etldb_13" {
  name   = "${local.name_prefix}-etldb-parameter-group-13"
  family = "postgres13"

  parameter {
    name         = "shared_preload_libraries"
    value        = "pg_stat_statements,pg_cron"
    apply_method = "pending-reboot"
  }

  parameter {
    name         = "cron.database_name"
    value        = "pd_etldb"
    apply_method = "pending-reboot"
  }
}

resource "aws_db_parameter_group" "etldb_17" {
  name   = "${local.name_prefix}-etldb-parameter-group-17"
  family = "postgres17"

  parameter {
    name         = "shared_preload_libraries"
    value        = "pg_stat_statements,pg_cron"
    apply_method = "pending-reboot"
  }

  parameter {
    name         = "cron.database_name"
    value        = "pd_etldb"
    apply_method = "pending-reboot"
  }
}

resource "aws_db_instance" "workflowdb_instance" {
  allocated_storage            = 666
  max_allocated_storage        = 1000
  storage_type                 = "gp3"
  engine                       = "postgres"
  engine_version               = "17.7"
  allow_major_version_upgrade  = true
  instance_class               = "db.r6g.xlarge"
  identifier                   = "${local.name_prefix}-workflowdb"
  apply_immediately            = true
  db_subnet_group_name         = aws_db_subnet_group.public.id
  performance_insights_enabled = true
  parameter_group_name         = aws_db_parameter_group.etldb_17.name
  vpc_security_group_ids = [
    module.main_sg_map.aurora_id,
    module.main_sg_map.db_debug_id
  ]
  publicly_accessible       = false
  snapshot_identifier       = "qa-delphi-workflowdb-kms"
  copy_tags_to_snapshot     = true
  backup_retention_period   = 7
  storage_encrypted         = true
  kms_key_id                = data.aws_kms_alias.default_rds.target_key_arn
  final_snapshot_identifier = "${local.name_prefix}-workflowdb-final-snapshot"

  lifecycle {
    ignore_changes = [password, allocated_storage, engine_version]
  }

  tags = merge(
    local.common_tags,
    {
      Name                     = "${local.name_prefix}-workflowdb"
      project                  = "Public Data",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_PD_RDS"
    }
  )
}

resource "aws_db_instance_role_association" "workflowdb_instance_export" {
  db_instance_identifier = aws_db_instance.workflowdb_instance.identifier
  feature_name           = "s3Export"
  role_arn               = module.rds_s3_export_role.role.arn
}

resource "aws_db_instance_role_association" "workflowdb_instance_import" {
  db_instance_identifier = aws_db_instance.workflowdb_instance.identifier
  feature_name           = "s3Import"
  role_arn               = module.rds_s3_import_role.role.arn
}

# Workflowdb proxy
data "aws_secretsmanager_secret" "workflowdb_proxy_users" {
  for_each = toset(var.workflowdb_proxy_secrets)
  name     = "${lower(var.platform["name"])}/${local.env_prefix}/${each.value}"
}

module "workflowdb_rds_standard_proxy" {
  source                       = "../../../modules/rds/proxy"
  name                         = "${local.name_prefix}-workflowdb-standard"
  rds_proxy_role_arn           = module.rds_proxy.role.arn
  db_instance_id               = aws_db_instance.workflowdb_instance.identifier
  vpc_subnet_ids               = module.main_private_subnets.subnet_ids
  idle_client_timeout          = 1800
  max_connections_percent      = 90
  max_idle_connections_percent = 45
  vpc_security_group_ids = [
    module.main_sg_map.aurora_id,
    module.main_sg_map.db_debug_id
  ]
  creds_secrets = [for secret in data.aws_secretsmanager_secret.workflowdb_proxy_users : secret.arn]
  tags = merge(
    local.common_tags,
    {
      project                  = "Public Data",
      service                  = "Aurora",
      plat_env_project_service = "${local.aggregated_tag}_PD_AURA"
    }
  )
}

# master-data
/*
resource "aws_db_instance" "master_data_instance" {
  allocated_storage     = 20
  max_allocated_storage = 100
  storage_type          = "gp3"
  engine                = "postgres"
  engine_version        = "13.10"
  instance_class        = "db.t4g.small"
  identifier            = "${local.name_prefix}-master-data"
  apply_immediately     = true
  db_subnet_group_name  = aws_db_subnet_group.private.id
  vpc_security_group_ids = [
    module.main_sg_map.aurora_id,
    module.main_sg_map.db_debug_id
  ]
  publicly_accessible     = false
  snapshot_identifier     = "qa-delphi-master-data-kms"
  copy_tags_to_snapshot   = true
  backup_retention_period = 7
  storage_encrypted       = true
  kms_key_id              = data.aws_kms_alias.default_rds.target_key_arn
  final_snapshot_identifier = "${local.name_prefix}-master-data-final-snapshot"

  lifecycle {
    ignore_changes = [password, allocated_storage, engine_version]
  }

  tags = merge(
    local.common_tags,
    {
      project                  = "Public Data",
      service                  = "RDS",
      plat_env_project_service = "${local.aggregated_tag}_PD_RDS"
    }
  )
}

resource "aws_db_instance_role_association" "master_data_instance_export" {
  db_instance_identifier = aws_db_instance.master_data_instance.identifier
  feature_name           = "s3Export"
  role_arn               = module.rds_s3_export_role.role.arn
}

resource "aws_db_instance_role_association" "master_data_instance_import" {
  db_instance_identifier = aws_db_instance.master_data_instance.identifier
  feature_name           = "s3Import"
  role_arn               = module.rds_s3_import_role.role.arn
} */