/*
 * Terraform networking resources for GCP.
 */


data "google_compute_network" "main" {
  name = var.gcp_network
}
/*
 * ----------VPN Connection----------
 */

resource "google_compute_address" "vpn_peer_ip" {
  name   = "aws-vpn-peer-${replace(local.aws_vpc_name, "_", "-")}"
  region = var.gcp_region
}

resource "google_compute_vpn_gateway" "aws_vpn_gw" {
  name    = "aws-vpn-gw-${replace(local.aws_vpc_name, "_", "-")}"
  network = data.google_compute_network.main.name
  region  = var.gcp_region
}

resource "google_compute_forwarding_rule" "fr_esp" {
  name        = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-fr-esp"
  ip_protocol = "ESP"
  ip_address  = google_compute_address.vpn_peer_ip.address
  target      = google_compute_vpn_gateway.aws_vpn_gw.self_link
}

resource "google_compute_forwarding_rule" "fr_udp500" {
  name        = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-fr-udp500"
  ip_protocol = "UDP"
  port_range  = "500-500"
  ip_address  = google_compute_address.vpn_peer_ip.address
  target      = google_compute_vpn_gateway.aws_vpn_gw.self_link
}

resource "google_compute_forwarding_rule" "fr_udp4500" {
  name        = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-fr-udp4500"
  ip_protocol = "UDP"
  port_range  = "4500-4500"
  ip_address  = google_compute_address.vpn_peer_ip.address
  target      = google_compute_vpn_gateway.aws_vpn_gw.self_link
}

/*
 * ----------VPN Tunnel1----------
 */

resource "google_compute_vpn_tunnel" "aws_tunnel_main" {
  name          = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-1"
  peer_ip       = aws_vpn_connection.gcp_tunnel_connection.tunnel1_address
  shared_secret = aws_vpn_connection.gcp_tunnel_connection.tunnel1_preshared_key
  ike_version   = 1

  target_vpn_gateway = google_compute_vpn_gateway.aws_vpn_gw.self_link

  router = google_compute_router.aws_vpn_router_main.name

  depends_on = [
    google_compute_forwarding_rule.fr_esp,
    google_compute_forwarding_rule.fr_udp500,
    google_compute_forwarding_rule.fr_udp4500,
  ]
}

resource "google_compute_router" "aws_vpn_router_main" {
  name    = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-1"
  region  = var.gcp_region
  network = data.google_compute_network.main.name
  bgp {
    asn = var.GCP_TUN_VPN_GW_ASN
  }
}

resource "google_compute_router_peer" "aws_vpn_router_peer_main" {
  name            = "gcp-to-aws-${replace(local.aws_vpc_name, "_", "-")}-1"
  router          = google_compute_router.aws_vpn_router_main.name
  region          = google_compute_router.aws_vpn_router_main.region
  peer_ip_address = aws_vpn_connection.gcp_tunnel_connection.tunnel1_vgw_inside_address
  peer_asn        = var.AWS_TUN_VPN_GW_ASN
  interface       = google_compute_router_interface.router_interface_main.name
}

resource "google_compute_router_interface" "router_interface_main" {
  name       = "gcp-to-aws-${replace(local.aws_vpc_name, "_", "-")}-1"
  router     = google_compute_router.aws_vpn_router_main.name
  region     = google_compute_router.aws_vpn_router_main.region
  ip_range   = "${aws_vpn_connection.gcp_tunnel_connection.tunnel1_cgw_inside_address}/${var.GCP_TUN1_CUSTOMER_GW_INSIDE_NETWORK_CIDR}"
  vpn_tunnel = google_compute_vpn_tunnel.aws_tunnel_main.name
}

/*
 * ----------VPN Tunnel2----------
 */

resource "google_compute_vpn_tunnel" "aws_tunnel_backup" {
  name          = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-2"
  peer_ip       = aws_vpn_connection.gcp_tunnel_connection.tunnel2_address
  shared_secret = aws_vpn_connection.gcp_tunnel_connection.tunnel2_preshared_key
  ike_version   = 1

  target_vpn_gateway = google_compute_vpn_gateway.aws_vpn_gw.self_link

  router = google_compute_router.aws_vpn_router_backup.name

  depends_on = [
    google_compute_forwarding_rule.fr_esp,
    google_compute_forwarding_rule.fr_udp500,
    google_compute_forwarding_rule.fr_udp4500,
  ]
}

resource "google_compute_router" "aws_vpn_router_backup" {
  name    = "aws-vpn-${replace(local.aws_vpc_name, "_", "-")}-2"
  region  = var.gcp_region
  network = data.google_compute_network.main.name
  bgp {
    asn = aws_customer_gateway.gcp_customer_gw.bgp_asn
  }
}

resource "google_compute_router_peer" "aws_vpn_router_peer_backup" {
  name            = "gcp-to-aws-${replace(local.aws_vpc_name, "_", "-")}-2"
  router          = google_compute_router.aws_vpn_router_backup.name
  region          = google_compute_router.aws_vpn_router_backup.region
  peer_ip_address = aws_vpn_connection.gcp_tunnel_connection.tunnel2_vgw_inside_address
  peer_asn        = var.AWS_TUN_VPN_GW_ASN
  interface       = google_compute_router_interface.router_interface_backup.name
}

resource "google_compute_router_interface" "router_interface_backup" {
  name       = "gcp-to-aws-${replace(local.aws_vpc_name, "_", "-")}-2"
  router     = google_compute_router.aws_vpn_router_backup.name
  region     = google_compute_router.aws_vpn_router_backup.region
  ip_range   = "${aws_vpn_connection.gcp_tunnel_connection.tunnel2_cgw_inside_address}/${var.GCP_TUN2_CUSTOMER_GW_INSIDE_NETWORK_CIDR}"
  vpn_tunnel = google_compute_vpn_tunnel.aws_tunnel_backup.name
}