data "aws_vpc" "main" {
  tags = {
    Name = "${local.name_prefix}-vpc"
  }
}

data "aws_subnets" "public_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-public-0*"
  }
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-private-0*"
  }
}

/* data "aws_security_group" "nexus" {
  tags = {
    Name = "${local.name_prefix}-sg-nexus"
  }
} */

data "aws_security_group" "alb" {
  tags = {
    Name = "${local.name_prefix}-sg-alb"
  }
}

locals {
  whitelisted_cidrs = [
    {
      "cidr"        = var.vpn_cidr,
      "description" = "Access from dev openvpn server"
    }
  ]
}

resource "aws_security_group" "octopus_server" {
  name        = "${local.name_prefix}-octopus-server"
  description = "Allow connections to octopus server"
  vpc_id      = data.aws_vpc.main.id
  # RDP
  dynamic "ingress" {
    for_each = local.whitelisted_cidrs
    content {
      description = ingress.value["description"]
      from_port   = 3389
      to_port     = 3389
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }
  #web
  ingress {
    description     = "Allow inbound traffic from ALB."
    from_port       = 80
    to_port         = 80
    protocol        = "tcp"
    security_groups = [data.aws_security_group.alb.id]
    self            = true
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 3389
    to_port         = 3389
    protocol        = "tcp"
    prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.infra_ec2_tags,
    {
      Name             = "${local.name_prefix}-octopus-server",
      "eiso-exception" = "aws.08.30",
    },
  )
}

resource "aws_security_group" "octopus_db" {
  name        = "${local.name_prefix}-octopus-db"
  description = "Allow connections to octopus server"
  vpc_id      = data.aws_vpc.main.id
  # MSSQL
  dynamic "ingress" {
    for_each = local.whitelisted_cidrs
    content {
      description = ingress.value["description"]
      from_port   = 1433
      to_port     = 1433
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Allow access from octopus server."
    from_port       = 1433
    to_port         = 1433
    protocol        = "tcp"
    security_groups = [aws_security_group.octopus_server.id]
    self            = true
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.infra_ec2_tags,
    {
      Name             = "${local.name_prefix}-octopus-db",
      "eiso-exception" = "aws.08.30",
    },
  )
}

resource "aws_security_group" "octopus_node" {
  name        = "${local.name_prefix}-octopus-node"
  description = "Allow connections to octopus server"
  vpc_id      = data.aws_vpc.main.id
  # SSH
  dynamic "ingress" {
    for_each = local.whitelisted_cidrs
    content {
      description = ingress.value["description"]
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Allow access from octopus server."
    from_port       = 22
    to_port         = 22
    protocol        = "tcp"
    security_groups = [aws_security_group.octopus_server.id]
    self            = true
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 22
    to_port         = 22
    protocol        = "tcp"
    prefix_list_ids = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    local.infra_ec2_tags,
    {
      Name             = "${local.name_prefix}-octopus-node",
      "eiso-exception" = "aws.08.30",
    },
  )
}

data "aws_ec2_managed_prefix_list" "vpn_ny_users" {
  filter {
    name   = "prefix-list-name"
    values = ["vpn-ny-users"]
  }
}