#
# Cookbook:: irrigate-neo4j
# Recipe:: ec2
#

# Add tag to show that node has successfully bootstrapped
unless node['ec2']['instance_id'].nil?
  aws_resource_tag node['ec2']['instance_id'] do
    action :add
    tags(
      'bootstrapped' => 'true'
    )
  end

  # Add DNS record. Examples: dev-neo4j-i-123456789, prod-neo4j-graph-i-123456789
  # If not running in AWS, add DNS records for hosts out of band
  # This address must be both unique and also covered by the CN of your SSL cert, if applicable
  node.override['neo4j']['config']['dbms.connectors.default_advertised_address'] =
    node['neo4j']['config']['dbms.connectors.default_advertised_address_prefix'] + '-' + node['ec2']['instance_id'] + '.' + node['neo4j']['route53']['domain_name']

  if node['neo4j']['route53']['networking_account_enabled']
    # If using a separate AWS account for networking, assume the role and create the record
    chef_gem 'aws-sdk-sts' do
      compile_time true
    end

    ruby_block 'assume_networking_account_role' do
      block do
        require 'aws-sdk-sts'
        begin
          sts_client = Aws::STS::Client.new(region: node['neo4j']['route53']['region'])
          assumed_role = sts_client.assume_role({
            role_arn: node['neo4j']['route53']['aws_role_arn'],
            role_session_name: node['neo4j']['route53']['aws_session_name'],
            external_id: node['neo4j']['route53']['aws_external_id'],
          }).credentials
          node.run_state['neo4j_networking_account_credentials'] = {
            access_key_id: assumed_role.access_key_id,
            secret_access_key: assumed_role.secret_access_key,
            session_token: assumed_role.session_token,
          }
        rescue Aws::STS::Errors::ServiceError => e
          Chef::Log.error("Failed to assume networking account role: #{e.message}")
          raise
        end
      end
      action :run
    end

    route53_record 'neo4j_member_networking_account_record' do
      name node['neo4j']['config']['dbms.connectors.default_advertised_address']
      value node['ipaddress']
      type 'A'
      zone_id node['neo4j']['route53']['networking_account_zone_id']
      overwrite true
      fail_on_error true
      aws_access_key_id lazy { node.run_state['neo4j_networking_account_credentials'][:access_key_id] }
      aws_secret_access_key lazy { node.run_state['neo4j_networking_account_credentials'][:secret_access_key] }
      aws_session_token lazy { node.run_state['neo4j_networking_account_credentials'][:session_token] }
      action :create
    end

  else
    route53_record 'neo4j_member_record' do
      name node['neo4j']['config']['dbms.connectors.default_advertised_address']
      value node['ipaddress']
      type 'A'
      zone_id node['neo4j']['route53']['zone_id']
      overwrite true
      fail_on_error true
      action :create
    end
  end

end