data "aws_vpc" "main" {
  tags = {
    Name = "${local.name_prefix}-vpc"
  }
}

data "aws_subnets" "public_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-public-0*"
  }
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-private-0*"
  }
}

data "aws_subnets" "private_db_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }

  tags = {
    Name = "${local.name_prefix}-subnet-private-db-0*"
  }
}

data "aws_security_group" "squid" {
  tags = {
    Name = "${local.name_prefix}-sg-squid"
  }
}

data "aws_security_group" "vpn" {
  tags = {
    Name = "${local.name_prefix}-sg-vpn"
  }
}

data "aws_security_group" "vpn_access" {
  tags = {
    Name = "${local.name_prefix}-sg-vpn-access"
  }
}

data "aws_security_group" "vpn_ssh" {
  tags = {
    Name = "${local.name_prefix}-sg-vpn-ssh"
  }
}

data "aws_security_group" "remote_access" {
  tags = {
    Name = "${local.name_prefix}-sg-remote-access-ssh"
  }
}

data "aws_security_group" "mysql" {
  tags = {
    Name = "${local.name_prefix}-sg-mysql"
  }
}

data "aws_security_group" "db_debug" {
  tags = {
    Name = "${local.name_prefix}-sg-db-debug"
  }
}

locals {
  vpn_instances_routes = [
    #"${tolist(module.openvpn_instance1.network_interface.private_ips)[0]}/32",
  ]
}
module "vpn_delphi_dev" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr = "10.50.0.0/16"
  vpc_accepter_cidr  = "10.30.0.0/16"
  connection_name    = "INFRA_TO_DLP_DEV"
  #acc_to_req_dest_cidrs = local.vpn_instances_routes
  allow_remote_vpc_dns_resolution = false
  accepter_account_id             = module.aws_accounts_list.accounts["gdb-delphi-dev"]

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-delphi-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_delphi_qa" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr = "10.50.0.0/16"
  vpc_accepter_cidr  = "10.31.0.0/16"
  connection_name    = "INFRA_TO_DLP_QA"
  #acc_to_req_dest_cidrs = local.vpn_instances_routes
  allow_remote_vpc_dns_resolution = false
  accepter_account_id             = module.aws_accounts_list.accounts["gdb-delphi-dev"]

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-delphi-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_delphi_stage" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr              = "10.50.0.0/16"
  vpc_accepter_cidr               = "10.32.0.0/16"
  connection_name                 = "INFRA_TO_DLP_STAGE"
  allow_remote_vpc_dns_resolution = false
  accepter_account_id             = module.aws_accounts_list.accounts["gdb-delphi-dev"]

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-delphi-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_apollo_dev" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr  = "10.50.0.0/16"
  vpc_accepter_cidr   = "10.10.0.0/16"
  connection_name     = "INFRA_TO_APL_DEV"
  accepter_account_id = module.aws_accounts_list.accounts["gdb-delphi-dev"]

  allow_remote_vpc_dns_resolution = false

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-delphi-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_apollo_new_dev" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr  = "10.50.0.0/16"
  vpc_accepter_cidr   = "10.11.0.0/16"
  connection_name     = "INFRA_TO_APL_NEW_DEV"
  accepter_account_id = module.aws_accounts_list.accounts["gdb-apollo-dev"]

  allow_remote_vpc_dns_resolution = false

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-apollo-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_apollo_new_qa" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr  = "10.50.0.0/16"
  vpc_accepter_cidr   = "10.14.0.0/16"
  connection_name     = "INFRA_TO_APL_NEW_QA"
  accepter_account_id = module.aws_accounts_list.accounts["gdb-apollo-dev"]

  allow_remote_vpc_dns_resolution = false

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-apollo-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "vpn_apollo_new_stage" {
  source = "../../../modules/vpc/peering/one-to-one-external"

  vpc_requester_cidr  = "10.50.0.0/16"
  vpc_accepter_cidr   = "10.15.0.0/16"
  connection_name     = "INFRA_TO_APL_NEW_STAGE"
  accepter_account_id = module.aws_accounts_list.accounts["gdb-apollo-dev"]

  allow_remote_vpc_dns_resolution = false

  providers = {
    aws.requester = aws
    aws.accepter  = aws.gdb-apollo-dev
  }

  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

# Peering to proxy network
module "sme_proxy_peering" {
  source = "../../../modules/vpc/peering/accepter"

  vpc_accepter_cidr               = data.aws_vpc.main.cidr_block
  peering_connection_id           = var.sme_proxy_peering_id
  connection_name                 = "${upper(var.platform.name)}_TO_PROXY_CLOUDOPS"
  acc_to_req_dest_cidrs           = ["10.12.249.0/24"]
  allow_remote_vpc_dns_resolution = false

  common_tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Networking",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_NTW"
    }
  )
}

# module "vpn_artistapp_dev" {
#   source = "../../../modules/vpc/peering/one-to-one-external"
#
#   vpc_requester_cidr              = "10.50.0.0/16"
#   vpc_accepter_cidr               = "10.70.0.0/16"
#   connection_name                 = "INFRA_TO_RTI_DEV"
#   allow_remote_vpc_dns_resolution = false
#   accepter_account_id             = module.aws_accounts_list.accounts["gdb-artistapp-dev"]
#
#   providers = {
#     aws.requester = aws
#     aws.accepter  = aws.gdb-artistapp-dev
#   }
#
#   common_tags = merge(
#     local.common_tags,
#     {
#       service                  = "VPN",
#       plat_env_project_service = "${local.aggregated_tag}_VPN"
#     }
#   )
# }

# module "vpn_artistapp_stage" {
#   source = "../../../modules/vpc/peering/one-to-one-external"
#
#   vpc_requester_cidr              = "10.50.0.0/16"
#   vpc_accepter_cidr               = "10.72.0.0/16"
#   connection_name                 = "INFRA_TO_RTI_STG"
#   allow_remote_vpc_dns_resolution = false
#   accepter_account_id             = module.aws_accounts_list.accounts["gdb-artistapp-dev"]
#
#   providers = {
#     aws.requester = aws
#     aws.accepter  = aws.gdb-artistapp-dev
#   }
#
#   common_tags = merge(
#     local.common_tags,
#     {
#       service                  = "VPN",
#       plat_env_project_service = "${local.aggregated_tag}_VPN"
#     }
#   )
# }

# For LetsEncrypt certification instances need access to changing DNS zone
/*
data aws_route53_zone delphi_zone {
  name = "delphi.zone."
}

resource aws_iam_policy delphizone_access {
  name        = "${local.name_prefix}-delphizone-route53"
  path        = "/"
  description = "Policy allows rw access to delphi.zone in route53"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Id": "certbot-dns-route53",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53:ListHostedZones",
                "route53:GetChange"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect" : "Allow",
            "Action" : [
                "route53:ChangeResourceRecordSets"
            ],
            "Resource" : [
                "arn:aws:route53:::hostedzone/${data.aws_route53_zone.delphi_zone.zone_id}"
            ]
        }
    ]
}
POLICY
}

resource aws_iam_role_policy_attachment vpn_delphizone_access {
  policy_arn = aws_iam_policy.delphizone_access.arn
  role       = module.main_iam_profiles.role_ec2.id
}
*/