# General variables
variable "environment" {
  description = "Name of the environment, e.g. dev, qa, prod"
  default     = "dev"
}

variable "service_name" {
  description = "Service name, without environment prefix"
  default     = "ows-service"
}

variable "use_existing_application" {
  description = "Whether to use an existing Elastic Beanstalk application with a name other than var.service_name. If true, you must also specify var.existing_application_name. Do not quote."
  default     = false
}

variable "existing_application_name" {
  description = "Name of existing application in which to create environment. Only applicable when var.use_existing_application is set to true"
  default     = ""
}

variable "environment_tier" {
  description = "Type of environment: can be either Worker or WebServer"
  default     = "WebServer"
}

variable "environment_wait_for_ready_timeout" {
  description = "How long to wait for environment to be ready before timing out"
  default     = "20m"
}

variable "datadog_enabled" {
  description = "Whether or not to attach datadog secretsmanager IAM policy"
  default     = true
}

variable "iam_policy_file_enabled" {
  description = "Does this function require additional IAM policies? If so set this to true and add a file in ./policies/<var.service_name>.json"
  default     = false
}

variable "iam_managed_policy_attachments" {
  description = "List of ARNs of existing IAM policies to attach to role"
  type        = list(string)
  default     = [""]
}

# ASG variables
variable "asg_availability_zones" {
  description = "Availability zones for ASG"
  default     = "Any 2"
}

variable "asg_cooldown" {
  description = "Cooldown period between ASG actions"
  default     = "300"
}

variable "asg_min_size" {
  description = "Minimum size for ASG"
  default     = "1"
}

variable "asg_max_size" {
  description = "Maximum size for ASG"
  default     = "2"
}

# Launch configuration settings
variable "launchconfiguration_block_device_mappings" {
  description = "Additional EBS volumes to attach"
  default     = "/dev/sdj=:10:true:gp2"
}

variable "launchconfiguration_keypair" {
  description = "SSH key used to connect to instances"
  default     = "orchard_admin"
}

variable "launchconfiguration_instance_type" {
  description = "Instance type"
  default     = "t3.small"
}

variable "launchconfiguration_monitoring_interval" {
  description = "Interval of monitoring checks"
  default     = "5 minute"
}

variable "launchconfiguration_root_volume_size" {
  description = "Instance root volume size"
  default     = "10"
}

variable "launchconfiguration_root_volume_type" {
  description = "Instance root volume type"
  default     = "gp2"
}

# Only allow ssh
variable "launchconfiguration_ssh_source_restriction" {
  description = "CIDR block from which to limit SSH access into instances. Do not change this value. Instead add rules to var.asg_additional_inbound_rules"
  default     = "169.254.169.254/32"
}

# Trigger settings
variable "trigger_breach_duration" {
  description = "How many consecutive trigger breaches before scaling action"
  default     = "5"
}

variable "trigger_lower_threshold" {
  description = "Lower threshold for scaling actions"
  default     = "20"
}

variable "trigger_measure_name" {
  description = "Metric type for scaling action checks"
  default     = "CPUUtilization"
}

variable "trigger_period" {
  description = "Period between metric evaluations"
  default     = "5"
}

variable "trigger_statistic" {
  description = "Statistic to use for the given measurement type"
  default     = "Average"
}

variable "trigger_unit" {
  description = "Unit used by checks for the given measurement type"
  default     = "Percent"
}

variable "trigger_upper_threshold" {
  description = "Upper threshold for scaling actions"
  default     = "80"
}

# Rolling update settings
variable "update_max_batch" {
  description = "Maximum number of instances to update at once"
  default     = "4"
}

variable "update_min_in_service" {
  description = "Minimum number of healthy instances in service"
  default     = "1"
}

variable "update_type" {
  description = "How to evaluate update completion"
  default     = "Health"
}

# VPC settings
variable "vpc_associate_public_ip_address" {
  description = "Whether or not to associate a public IP address with ELB. Should not typically be used"
  default     = "false"
}

variable "vpc_elb_scheme" {
  description = "Type of ELB"
  default     = "internal"
}

variable "vpc_elb_subnets" {
  description = "Subnets for ELB placement"
  default     = "subnet-44c19a21,subnet-b649dfef"
}

variable "vpc_subnets" {
  description = "Subnets for ASG/instance placement"
  default     = "subnet-44c19a21,subnet-b649dfef"
}

variable "vpc_id" {
  description = "VPC to run this environment"
  default     = "vpc-34dbfd51"
}

# Environment variables
# This must be a list of maps with at least one element. Separate key = value with a single space only. Do not align.
variable "environment_variables" {
  type = list(object({
    namespace = string
    name      = string
    value     = string
  }))

  default = [
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "Environment"
      value     = "dev"
    },
  ]
}

# Cloudwatch log settings
variable "cloudwatch_stream_logs" {
  description = "Whether or not to stream logs to Cloudwatch"
  default     = "true"
}

variable "cloudwatch_delete_on_termination" {
  description = "Whether or not to delete logs from Cloudwatch on environment termination"
  default     = "false"
}

variable "cloudwatch_retention_in_days" {
  description = "Number of days to retain logs in Cloudwatch"
  default     = "7"
}

# Deployment settings
variable "deployment_batch_size_type" {
  description = "Method used to determine updates (Percentage, Number)"
  default     = "Percentage"
}

variable "deployment_batch_size" {
  description = "What percent or number to deploy at once"
  default     = "50"
}

variable "deployment_update_type" {
  description = "Deployment type (AllAtOnce, Rolling, etc...)"
  default     = "Rolling"
}

variable "deployment_timeout" {
  description = "Number of seconds to wait for each instance to complete deployment"
  default     = "1200"
}

# Environment settings
variable "environment_type" {
  description = "Type of environment: can be either SingleInstance or LoadBalanced"
  default     = "LoadBalanced"
}

variable "environment_loadbalancer_type" {
  description = "Type of load balancer: can be either application, classic, or network"
  default     = "classic"
}

variable "environment_service_role" {
  description = "IAM role to use to manage environment resources. This should not typically be changed"
  default     = "aws-elasticbeanstalk-service-role"
}

# Default instance process settings.
variable "process_instance_health_check_interval" {
  description = "Interval of default process monitoring checks"
  default     = "10"
}

variable "process_instance_health_check_path" {
  description = "Default process health check path"
  default     = "/hello/"
}

variable "process_instance_health_check_matcher_code" {
  description = "List of HTTP codes that indicate instance health. For application and classic load balancers only."
  default     = "200"
}

variable "process_port" {
  description = "Default instance process port"
  default     = "80"
}

variable "process_protocol" {
  description = "Default instance process protocol. Set to HTTP, HTTPS, or TCP."
  default     = "HTTP"
}

variable "process_stickiness_enabled" {
  description = "Whether to enable sticky sessions. For application and classic load balancers."
  default     = "false"
}

# Managed update settings
variable "managed_update_preferred_start_time" {
  description = "When to apply managed updates"
  default     = "Mon:12:00"
}

variable "managed_update_weekly_instance_replacement" {
  description = "Whether to replace instances weekly as part of managed updates"
  default     = "true"
}

# Notification settings
variable "notification_endpoints" {
  description = "Email address for environment notifications"
  default     = "it@theorchard.com"
}

# ELB health check settings. Only applicable for classic load balancers.
variable "elb_health_check_healthy_threshold" {
  description = "Consecutive successful checks before instance is deemed healthy"
  default     = "3"
}

variable "elb_health_check_interval" {
  description = "Interval between health checks"
  default     = "10"
}

variable "elb_health_check_unhealthy_threshold" {
  description = "Consecutive unsuccessful checks before instance is deemed unhealthy"
  default     = "3"
}

# General load balancer settings
variable "asg_additional_inbound_rules" {
  description = "List of maps, each of which contains a single CIDR block, port, and protocol from which to allow access into instances. Change if access should be customized"
  type = list(object({
    cidr_block = string
    port       = number
    protocol   = string
  }))

  default = [
    {
      cidr_block = "10.141.0.0/29"
      port       = 22
      protocol   = "TCP"
    },
    {
      cidr_block = "10.10.141.0/29"
      port       = 22
      protocol   = "TCP"
    },
    {
      cidr_block = "10.0.0.0/8"
      port       = "-1"
      protocol   = "ICMP"
    },
  ]
}

variable "load_balancer_egress_protocol" {
  description = "Protocol used for load balancer egress rule. Should not typically be changed"
  default     = "TCP"
}

variable "load_balancer_inbound_allowed_cidr_blocks" {
  description = "List of CIDR blocks from which to allow access into load balancer. Change if access should be customized"
  type        = list(string)
    default = [
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
  ]
}

variable "load_balancer_listener_port" {
  description = "Listener port for load balancer"
  default     = "443"
}

variable "load_balancer_listener_protocol" {
  description = "Protocol for load balancer listener. Set to HTTPS, TCP, or HTTP (not recommended)"
  default     = "HTTPS"
}

variable "load_balancer_ssl_certificate_arn" {
  description = "ARN of SSL certificate for secure load balancer listener"
  default     = "arn:aws:acm:us-east-1:103233932089:certificate/a1a3c6c2-523f-4f79-ba24-ce69f21ac066"
}

variable "load_balancer_ssl_policy" {
  description = "Policy applied to secure load balancer listener"
  default     = "ELBSecurityPolicy-TLS-1-2-2017-01"
}

variable "elb_connection_draining_enabled" {
  description = "Whether to maintain connections to unhealthy or deregistered instances to complete requests"
  default     = "true"
}

variable "elb_connection_draining_timeout" {
  description = "How long to maintain connections to unhealthy or deregistered instances to complete requests"
  default     = "300"
}

variable "elb_connection_idle_timeout" {
  description = "Seconds the load balancer waits for send/receive data before closing connection"
  default     = "60"
}

variable "elb_connection_stickiness_policy" {
  description = "Whether to enable sticky sessions"
  default     = "false"
}

# Application load balancer settings
variable "elb_v2_access_logs_s3_bucket" {
  description = "S3 bucket used to store application load balancer access logs. Access to this location is not managed by this module"
  default     = "aws-logs-103233932089-us-east-1"
}

variable "elb_v2_access_logs_enabled" {
  description = "Whether to store application load balancer access logs"
  default     = "false"
}

# Route53 settings
variable "aws_route53_record_ttl" {
  description = "TTL associated with Route53 CNAME record"
  default     = "60"
}

variable "aws_route53_zone_id" {
  description = "AWS Route 53 zone id"
  default     = "Z21XEY26C989RH"
}

# Helper locals for programmatic generation. These should not be changed.
locals {
  datadog_secrets_manager_policy_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecretsManager-${var.environment}-datadog-policy"

  elb_v2_access_logs_s3_prefix = "${var.environment}-${var.service_name}"

  # Health check URL. An resulting example is "HTTP:80/hello/"
  healthcheck_url = "${var.process_protocol}:${var.process_port}${var.process_instance_health_check_path}"

  # Settings for application and network load balancers
  load_balancer_v2_listener_settings = {
    WebServer = [
      {
        namespace = "aws:elbv2:listener:default"
        name      = "ListenerEnabled"
        value     = "false"
      },
      {
        namespace = "aws:elbv2:listener:${var.load_balancer_listener_port}"
        name      = "ListenerEnabled"
        value     = "true"
      },
      {
        namespace = "aws:elbv2:listener:${var.load_balancer_listener_port}"
        name      = "DefaultProcess"
        value     = "default"
      },
      {
        namespace = "aws:elbv2:listener:${var.load_balancer_listener_port}"
        name      = "Protocol"
        value     = var.load_balancer_listener_protocol
      },
      {
        namespace = "aws:elbv2:listener:${var.load_balancer_listener_port}"
        name      = "SSLCertificateArns"
        value     = var.load_balancer_ssl_certificate_arn
      },
      {
        namespace = "aws:elbv2:listener:${var.load_balancer_listener_port}"
        name      = "SSLPolicy"
        value     = var.load_balancer_ssl_policy
      },
    ]
    Worker = [
      {
        # Set a dummy environment variable so that this list is not empty
        namespace = "aws:elasticbeanstalk:application:environment"
        name      = "load_balancer_v2_listener_settings"
        value     = "disabled"
      },
    ]
  }

  # Settings for classic load balancers
  load_balancer_listener_settings = {
    WebServer = [
      {
        namespace = "aws:elb:listener"
        name      = "ListenerEnabled"
        value     = "false"
      },
      {
        namespace = "aws:elb:listener:${var.load_balancer_listener_port}"
        name      = "ListenerEnabled"
        value     = "true"
      },
      {
        namespace = "aws:elb:listener:${var.load_balancer_listener_port}"
        name      = "ListenerProtocol"
        value     = var.load_balancer_listener_protocol
      },
      {
        namespace = "aws:elb:listener:${var.load_balancer_listener_port}"
        name      = "InstancePort"
        value     = var.process_port
      },
      {
        namespace = "aws:elb:listener:${var.load_balancer_listener_port}"
        name      = "InstanceProtocol"
        value     = var.process_protocol
      },
      {
        namespace = "aws:elb:listener:${var.load_balancer_listener_port}"
        name      = "SSLCertificateId"
        value     = var.load_balancer_ssl_certificate_arn
      },
    ]
    Worker = [
      {
        # Set a dummy environment variable so that this list is not empty
        namespace = "aws:elasticbeanstalk:application:environment"
        name      = "load_balancer_listener_settings"
        value     = "disabled"
      },
    ]
  }
}