locals {
  a0deploy_secrets = [
    "AUTH0_CLIENT_ID",
    "AUTH0_CLIENT_SECRET",
  ]
  a0deploy_secrets_list = [
    for k, v in aws_secretsmanager_secret.a0deploy_secret :
    {
      name      = k,
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
    }
  ]
}

resource "aws_secretsmanager_secret" "a0deploy_secret" {
  for_each = toset(local.a0deploy_secrets)

  name       = "${local.secrets_name_prefix}/a0deploy/${each.value}"
  kms_key_id = module.kms_secrets_manager.serviceonly_key.key_id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "a0deploy_role" {
  source = "../../modules/iam/roles/ecs_task_role"

  name_prefix = local.name_prefix
  name        = "a0deploy-role"

  policies_list = [
    module.auth0_backups_bucket_rw.policy.arn,
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Auth0",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_A0_ECS"
    }
  )
}

module "a0deploy_ecs" {
  source = "../../modules/ecs/tasks/scheduled_task_v3"

  cluster_arn   = aws_ecs_cluster.main.arn
  cpu           = 512
  env_prefix    = local.env_prefix
  image         = "${module.a0deploy.ecr.repository_url}:latest"
  memory        = 1024
  project       = "a0deploy"
  project_group = local.project_group

  schedule_expression = {
    everyday_at_midnight = {
      expression = "cron(0 0 * * ? *)",
      enabled    = true
    }
  }

  scheduler_role_arn = module.ecs_scheduler_role.role.arn
  security_groups    = [module.main_sg_map.pulbic_web_id]
  subnets            = module.main_private_subnets.subnet_ids
  task_role_arn      = module.a0deploy_role.role.arn
  task_exec_role_arn = module.ecs_task_runner_role.role.arn
  command            = ["--export"]
  secrets            = local.a0deploy_secrets_list

  env_vars = [
    {
      name  = "AUTH0_DOMAIN",
      value = "sme-dna.auth0.com"
    },
    {
      name  = "AUTH0_TENANT_NAME",
      value = "sma-dna"
    },
    {
      name  = "AUTH0_ALLOW_DELETE",
      value = "false"
    },
    {
      name  = "BUCKET_NAME",
      value = "dev-infra-auth0-backups"
    },
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Auth0",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_A0_ECS"
    }
  )
}