/*
locals {
  atlas_auth_proxy_secrets_list = [
    "SESSION_SECRET",
    "SENTRY_DSN",
  ]

  atlas_auth_proxy_secrets_mapping_list = [
    for k, v in aws_secretsmanager_secret.atlas_auth_proxy_secret :
    {
      name      = k,
      valueFrom = "arn:aws:secretsmanager:${var.aws_region_id}:${local.account_id}:secret:${v["name"]}"
    }
  ]

  atlas_auth_proxy_env_vars = [
    {
      name  = "FLASK_ENV",
      value = local.environment
    },
    {
      name  = "LOGIN_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um"]}/usm/login"
    },
    {
      name  = "LOGOUT_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um"]}/usm/logout"
    },
    {
      name  = "PUBLIC_KEY_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um-static"]}/pem/public.pem"
    },
    {
      name = "ORIGINS",
      value = join(",",
        [
          "https://${module.domains[local.env_prefix]["web"]}",
          "https://${module.domains[local.env_prefix]["atlas-um-example"]}",
          "http://localhost:4000",
          "https://localhost:4000",
          "https://local.dna.stream:4000",
          "http://local.dna.stream:4000",
        ]
      )
    },
    {
      name = "ALLOWED_HOSTS",
      value = join(",",
        [
          module.domains[local.env_prefix]["atlas-auth-proxy"],
        ]
      )
    },
    {
      name  = "REFRESH_URL",
      value = "https://${module.atlas_domains[local.env_prefix]["atlas-um"]}/usm/token/refresh"
    },
    {
      name = "DNA_BEARER_TOKEN_COOKIE_NAME",
      value = "dna_bearer_token_${local.env_prefix}"
    },
    {
      name = "DNA_REFRESH_TOKEN_COOKIE_NAME",
      value = "dna_refresh_token_${local.env_prefix}"
    },
  ]
}

data "aws_ecr_repository" "atlas_auth_proxy" {
  name = "core/auth-proxy"

  provider = aws.gdb-core-dev
}

resource "aws_secretsmanager_secret" "atlas_auth_proxy_secret" {
  for_each = toset(local.atlas_auth_proxy_secrets_list)

  name       = "${local.secrets_name_prefix}/atlas-auth-proxy/${each.value}"
  kms_key_id = data.aws_kms_key.secrets_general_key.id

  tags = merge(
    local.common_tags,
    {
      project                  = "Infrastructure",
      service                  = "Secrets Manager",
      plat_env_project_service = "${local.aggregated_tag}_INFRA_SCRT"
    }
  )
}

module "atlas_auth_proxy_task_def" {
  source = "../../../modules/ecs/tasks/fargate_v3"

  env_prefix      = local.env_prefix
  project_group   = local.project_group
  family          = "${local.env_prefix}-${local.project_group}-atlas-auth-proxy"
  container_name  = "atlas-auth-proxy"
  container_image = "${data.aws_ecr_repository.atlas_auth_proxy.repository_url}:${local.docker_image_env_tag[local.env_prefix]}-${local.project_group}"
  cpu             = 1024
  memory          = 2048

  awslogs_retention = module.cloudwatch_logs_retention_by_env[local.env_prefix]

  entrypoint       = ["/opt/venv/bin/ddtrace-run", "/opt/venv/bin/uwsgi", "--ini", "/etc/uwsgi/uwsgi.ini"]
  defender_enabled = true

  task_role_arn = data.aws_iam_role.standard_exec.arn
  exec_role_arn = data.aws_iam_role.standard_exec.arn

  env_vars = local.atlas_auth_proxy_env_vars
  secrets  = local.atlas_auth_proxy_secrets_mapping_list

  port_mappings = [
    {
      containerPort = 8000
      hostPort      = 8000
      protocol      = "tcp"
    }
  ]

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}

module "atlas_auth_proxy_service" {
  source = "../../../modules/ecs/services/service_taskless_v2"

  env_prefix    = local.env_prefix
  project       = "atlas-auth-proxy"
  project_group = local.project_group

  cluster_arn   = data.aws_ecs_cluster.main.arn
  desired_count = 1

  security_groups = [data.aws_security_group.ecs.id]
  subnets         = data.aws_subnets.private_subnets.ids
  vpc_id          = data.aws_vpc.main.id

  task_definition_arn = module.atlas_auth_proxy_task_def.arn

  alb_enabled             = true
  https_listener_arn      = data.aws_lb_listener.external_https_listener.arn
  tg_health_check_path    = "/health"
  tg_health_check_matcher = "200"
  container_port          = 8000
  url                     = module.domains[local.env_prefix]["atlas-auth-proxy"]

  enable_ecs_managed_tags = true

  common_tags = merge(
    local.common_tags,
    {
      project                  = "User Management",
      service                  = "ECS",
      plat_env_project_service = "${local.aggregated_tag}_UM_ECS"
    }
  )
}

resource "aws_route53_record" "atlas_auth_proxy_record" {
  provider = aws.gdb-whitelist-legacy

  zone_id = data.aws_route53_zone.main.zone_id
  name    = module.domains[local.env_prefix]["atlas-auth-proxy"]
  type    = "A"

  alias {
    name                   = data.aws_lb.external_alb.dns_name
    zone_id                = data.aws_lb.external_alb.zone_id
    evaluate_target_health = false
  }
}
*/