resource "aws_cloudwatch_log_group" "main" {
  count             = var.awslogs_create_group ? 1 : 0
  name              = local.awslogs_group_name
  retention_in_days = var.awslogs_retention
  tags              = var.common_tags
}

module "main" {
  source = "github.com/borysbabii/terraform-aws-ecs-container-definition"
  // version = "0.56.0"

  container_name    = var.container_name
  container_image   = var.container_image
  port_mappings     = var.port_mappings
  mount_points      = local.mount_points
  environment       = local.env_vars
  secrets           = var.secrets
  command           = var.command
  working_directory = var.working_directory
  ulimits           = var.ulimits
  docker_labels     = var.datadog_enabled ? merge(var.docker_labels, local.dd_docker_labels) : var.docker_labels
  entrypoint        = local.entrypoint
  volumes_from      = local.volumes_from
  healthcheck       = var.healthcheck
  stop_timeout      = var.stop_timeout
  user              = var.user
  system_controls   = var.system_controls


  linux_parameters = var.defender_enabled ? {
    capabilities = {
      add = [
        "SYS_PTRACE"
      ]
      drop = []
    },
    devices            = null,
    initProcessEnabled = var.init_process_enabled,
    maxSwap            = null,
    sharedMemorySize   = null,
    swappiness         = null,
    tmpfs              = null
    } : (coalesce(var.init_process_enabled, false) ? {
      capabilities       = null
      devices            = null,
      initProcessEnabled = var.init_process_enabled,
      maxSwap            = null,
      sharedMemorySize   = null,
      swappiness         = null,
      tmpfs              = null
  } : null)

  log_configuration = {
    logDriver = "awslogs"
    options = {
      "awslogs-group"         = local.awslogs_group_name
      "awslogs-region"        = var.awslogs_region
      "awslogs-stream-prefix" = var.awslogs_stream_prefix
    }
    secretOptions = null
  }

  container_depends_on = var.defender_enabled ? [
    {
      containerName = "TwistlockDefender",
      condition     = "START"
    }
  ] : []
}

module "datadog" {
  count  = var.datadog_enabled ? 1 : 0
  source = "github.com/borysbabii/terraform-aws-ecs-container-definition"
  // version = "0.56.0"

  container_name  = var.dd_container_name
  container_image = var.dd_container_image
  environment     = local.dd_env_vars
  secrets         = var.dd_secrets
  volumes_from    = local.volumes_from
  mount_points    = local.mount_points
  entrypoint      = local.dd_entrypoint
  port_mappings   = var.dd_port_mappings
  docker_labels = {
    "traefik.enable" = "false"
  }

  linux_parameters = var.defender_enabled ? {
    capabilities = {
      add = [
        "SYS_PTRACE"
      ]
      drop = []
    },
    devices            = null,
    initProcessEnabled = null,
    maxSwap            = null,
    sharedMemorySize   = null,
    swappiness         = null,
    tmpfs              = null
  } : null

  container_cpu                = 10
  container_memory_reservation = 256

  log_configuration = {
    logDriver = "awslogs"
    options = {
      "awslogs-group"         = var.dd_awslogs_group
      "awslogs-region"        = var.awslogs_region
      "awslogs-stream-prefix" = var.awslogs_stream_prefix
    }
    secretOptions = null
  }

  container_depends_on = var.defender_enabled ? [
    {
      containerName = "TwistlockDefender",
      condition     = "START"
    }
  ] : []
}

module "defender" {
  count  = var.defender_enabled ? 1 : 0
  source = "github.com/borysbabii/terraform-aws-ecs-container-definition"
  // version = "0.56.0"

  container_name  = "TwistlockDefender"
  container_image = "registry-auth.twistlock.com/tw_hhj1mgkdltbmg1qkiuf2txenuzmnpmfp/twistlock/defender:defender_32_01_128"
  entrypoint = [
    "/usr/local/bin/defender",
    "fargate",
    "sidecar"
  ]

  environment = [
    {
      name  = "DEFENDER_TYPE",
      value = "fargate"
    },
    {
      name  = "FARGATE_TASK",
      value = var.family
    },
    {
      name  = "FARGATE_CONTAINERS",
      value = base64encode(jsonencode(local.containers))
    },
    {
      name  = "WS_ADDRESS",
      value = "wss://us-west1.cloud.twistlock.com:443"
    },
    {
      name  = "INSTALL_BUNDLE",
      value = "eyJzZWNyZXRzIjp7InNlcnZpY2UtcGFyYW1ldGVyIjoiQ3ZTMzVHcEN0dEVnaVVHRlQ4QW5vNzVtNXdPcmJwS29sTGkwbnVOMkxldWxxczByNG9IQ2VyZHpRWDdiRTNIQ3pmTWxzNG8yaE9VU3lZUjNHMlpWdEE9PSJ9LCJnbG9iYWxQcm94eU9wdCI6eyJodHRwUHJveHkiOiIiLCJub1Byb3h5IjoiIiwiY2EiOiIiLCJ1c2VyIjoiIiwicGFzc3dvcmQiOnsiZW5jcnlwdGVkIjoiIn19LCJjdXN0b21lcklEIjoidXMtMy0xNTkxODEyNjgiLCJhcGlLZXkiOiJVb3BtdmtHYjZpZjFhS0VsZXpvSVhVR3hDRGhBeXJwcXlMRVFzNG9MSUR1SUhwTUE1ems3aW0vd2VOSkludjJWZXdWTC9FQTFWMERwL1dQRkNtbDhMdz09IiwibWljcm9zZWdDb21wYXRpYmxlIjpmYWxzZX0="
    },
  ]

  secrets = var.defender_secrets

  docker_labels = {
    "traefik.enable" = "false"
  }

  mount_points = [
    {
      containerPath = "/var/lib/twistlock/fargate/policy",
      readOnly      = false
      sourceVolume  = "tw_policy"
    }
  ]

  log_configuration = {
    logDriver = "awslogs"
    options = {
      "awslogs-group"         = local.awslogs_group_name
      "awslogs-region"        = var.awslogs_region
      "awslogs-stream-prefix" = var.awslogs_stream_prefix
    }
    secretOptions = null
  }
}

resource "aws_ecs_task_definition" "main" {
  family                   = var.family
  task_role_arn            = var.task_role_arn
  execution_role_arn       = var.exec_role_arn
  network_mode             = "awsvpc"
  requires_compatibilities = ["EC2"]
  cpu                      = var.cpu
  memory                   = var.memory
  tags                     = var.common_tags

  dynamic "ephemeral_storage" {
    for_each = local.ephemeral_storage_enabled
    content {
      size_in_gib = var.ephemeral_storage_size
    }
  }

  container_definitions = local.container_definitions

  dynamic "volume" {
    for_each = local.efs_volume_enabled

    content {
      name = var.efs_volume_name

      efs_volume_configuration {
        file_system_id = var.efs_file_system_id
        root_directory = var.efs_root_directory
      }
    }
  }

  dynamic "volume" {
    for_each = local.defender_volumes
    content {
      name = "tw_policy"
    }
  }

  lifecycle {
    create_before_destroy = true
  }
}