module "ec2_sonar" {
  source = "../../../modules/ec2/ec2"

  name_prefix     = "${local.name_prefix}-sonar"
  instances_count = 1
  ami             = "ami-06d8040357413bf4c"
  instance_type   = "t3.medium"
  use_public_ip   = false
  key_name        = var.key_pair_name
  security_groups = [
    aws_security_group.sg_sonar.id,
    data.aws_security_group.remote_access.id,
  ]
  subnet_ids           = data.aws_subnets.private_subnets.ids
  iam_instance_profile = aws_iam_instance_profile.ec2_sonar.name
  root_volume_size     = 30
  root_volume_type     = "gp3"
  encrypted            = true
  kms_key_id           = data.aws_kms_alias.default_ebs_key.target_key_arn

  instance_tags = {
    os_platform     = "linux",
    os_distribution = "amazon",
    splunk          = "true",
    role            = "sonar",
  }

  common_tags = local.sonar_tags
}

module "tg_sonar" {
  source = "../../../modules/ec2/tg"

  name_prefix = local.name_prefix
  common_tags = local.sonar_tags

  tg_name              = "sonar"
  tg_vpc_id            = data.aws_vpc.main.id
  tg_port              = 9000
  tg_health_check_path = "/"
  tg_targets           = module.ec2_sonar.ec2[*].id
}

module "alb_rules_sonar" {
  source = "../../../modules/ec2/alb/https_rule_with_redirect"

  https_listener_arn = data.aws_alb_listener.private_alb_https.arn
  http_listener_arn  = data.aws_alb_listener.private_alb_http.arn
  tg_arn             = module.tg_sonar.tg.arn
  host-header        = module.domains.dev["sonar_external"]
}

module "tg_sonar_internal" {
  source = "../../../modules/ec2/tg"

  name_prefix = local.name_prefix
  common_tags = local.sonar_tags

  tg_name              = "sonar-internal"
  tg_vpc_id            = data.aws_vpc.main.id
  tg_port              = 8081
  tg_health_check_path = "/"
  tg_targets           = module.ec2_sonar.ec2[*].id
}

module "internal_alb_rules_sonar" {
  source = "../../../modules/ec2/alb/https_rule_with_redirect"

  https_listener_arn = data.aws_alb_listener.internal_alb_https.arn
  http_listener_arn  = data.aws_alb_listener.internal_alb_http.arn
  tg_arn             = module.tg_sonar_internal.tg.arn
  host-header        = module.domains.dev["sonar_internal"]
}

resource "aws_iam_role" "ec2_sonar" {
  name               = "${local.name_prefix}-sonar-ec2"
  description        = "Role for Jenkins EC2 slave instances"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.ec2_server.json
}

resource "aws_iam_instance_profile" "ec2_sonar" {
  name = "${local.name_prefix}-sonar-ec2"
  role = aws_iam_role.ec2_sonar.name
}

data "aws_iam_policy_document" "ec2_sonar_ecr" {
  statement {
    sid    = "sonarECRRepoAccess"
    effect = "Allow"
    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
    ]
    resources = [
      module.sonar_ecr.ecr.arn,
    ]
  }
  statement {
    sid    = "sonarECRAuth"
    effect = "Allow"
    actions = [
      "ecr:GetAuthorizationToken",
    ]
    resources = [
      "*",
    ]
  }
}

resource "aws_iam_policy" "ec2_sonar_ecr" {
  name        = "${local.name_prefix}-sonar-ecr"
  path        = "/"
  description = "Allows sonar to get images from infra ECR"
  policy      = data.aws_iam_policy_document.ec2_sonar_ecr.json
}

resource "aws_iam_role_policy_attachment" "ec2_sonar_ecr" {
  role       = aws_iam_role.ec2_sonar.id
  policy_arn = aws_iam_policy.ec2_sonar_ecr.arn
}