# Mysql Database for OpenVPN
/* resource "random_password" "master_password" {
  length           = 24
  special          = true
  override_special = "!#$%&*-_=+[]{}<>:?"
} */

resource "aws_db_subnet_group" "main" {
  name       = "${local.name_prefix}-privatedb"
  subnet_ids = module.main_private_db_subnets.subnet_ids
  tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

/* resource "aws_db_instance" "openvpn" {
  allocated_storage         = 20
  storage_type              = "gp2"
  engine                    = "mysql"
  engine_version            = "8.0.34"
  instance_class            = "db.t3.small"
  identifier                = "${local.name_prefix}-openvpn"
  parameter_group_name      = "default.mysql8.0"
  copy_tags_to_snapshot     = true
  db_subnet_group_name      = aws_db_subnet_group.main.id
  vpc_security_group_ids    = [module.main_sg_map.mysql_id, module.main_sg_map.db_debug_id]
  backup_retention_period   = 7
  snapshot_identifier       = "arn:aws:rds:us-east-1:890208661333:snapshot:prod-infra-openvpn-final-enc-snapshot"
  final_snapshot_identifier = "${local.name_prefix}-openvpn-final-snapshot"
  kms_key_id                = data.aws_kms_alias.default_rds.target_key_arn
  storage_encrypted         = true
  deletion_protection       = false
  skip_final_snapshot       = true

  tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )

  lifecycle {
    ignore_changes = [password, engine_version]
  }
} */

resource "aws_security_group_rule" "old_vpn_mysql" {
  from_port         = 3306
  to_port           = 3306
  type              = "ingress"
  security_group_id = module.main_sg_map.mysql_id
  protocol          = "tcp"
  cidr_blocks       = ["10.52.0.0/16"]
  description       = "Access from old infra account"
}


# Get arn of production vpn instance role to allow it to assume route53_reader role as well
data "aws_iam_role" "delphi_vpn_route53_reader_role" {
  provider = aws.gdb-delphi-dev
  name     = "infra-vpn_route53_reader_role"
}

data "aws_iam_role" "core_vpn_route53_reader_role" {
  provider = aws.gdb-core-dev
  name     = "infra-vpn_route53_reader_role"
}

data "aws_iam_role" "whitelist_vpn_route53_reader_role" {
  provider = aws.gdb-whitelist-legacy
  name     = "infra-vpn_route53_reader_role"
}

data "aws_iam_role" "certbot_delphi_zone_role" {
  provider = aws.gdb-delphi-prod
  name     = "infra-certbot_delphi_zone_role"
}

# Allow assuming roles created above
data "aws_iam_policy_document" "vpn_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    resources = [
      data.aws_iam_role.delphi_vpn_route53_reader_role.arn,
      data.aws_iam_role.certbot_delphi_zone_role.arn,
      data.aws_iam_role.core_vpn_route53_reader_role.arn,
    ]
  }
}

resource "aws_iam_policy" "vpn_assume_role" {
  name        = "${local.name_prefix}-vpn-assume-role-policy"
  description = "Allows to assume roles for vpn servers"
  policy      = data.aws_iam_policy_document.vpn_assume_role.json
}

module "openvpn_instance_role" {
  source      = "../../modules/iam/roles/ec2_instance_role"
  name_prefix = local.name_prefix
  name        = "openvpn_instance_role"
  policies_list = [
    aws_iam_policy.vpn_assume_role.arn,
    module.logging_policy.policy.arn,
  ]
  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

/* module "openvpn_instance1" {
  source      = "../../infrastructure/modules/ec2_openvpn"
  name_prefix = local.name_prefix
  key_name    = "${local.name_prefix}-default"
  sg_list = [
    module.main_sg_map.vpn_id,
    module.main_sg_map.vpn_access_id,
    module.main_sg_map.vpn_ssh_id,
    module.main_sg_map.ext_web_id,
  ]
  subnet               = module.main_public_subnets.subnet_ids[0]
  iam_instance_profile = module.openvpn_instance_role.profile.name
  instance_index       = "1"
  ami                  = "ami-0fb32865fc25e0519"
  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
}

module "openvpn_instance2" {
  source      = "../../infrastructure/modules/ec2_openvpn"
  name_prefix = local.name_prefix
  key_name    = "${local.name_prefix}-default"
  sg_list = [
    module.main_sg_map.vpn_id,
    module.main_sg_map.vpn_access_id,
    module.main_sg_map.vpn_ssh_id,
    module.main_sg_map.ext_web_id,
  ]
  subnet               = module.main_public_subnets.subnet_ids[1]
  iam_instance_profile = module.openvpn_instance_role.profile.name
  instance_index       = "2"
  ami                  = "ami-018b70db344a9c6ea"
  common_tags = merge(
    local.common_tags,
    {
      service                  = "VPN",
      plat_env_project_service = "${local.aggregated_tag}_VPN"
    }
  )
} */