provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/graphql-switchboard/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_vpc_peering_connection" "sme_pc" {
  tags = {
    Name = "${var.environment}-sme-switchboard"
  }
}

module "graphql_switchboard_vpc" {
  source = "../modules/vpc"

  environment        = var.environment
  service_name       = var.service_name
  aws_region         = var.aws_region
  transit_gateway_id = data.aws_ec2_transit_gateway.networking_transit_gateway.id
  vpc_cidr_block     = "10.120.0.0/16"

  vpc_peering_routes = {
    "${data.aws_vpc_peering_connection.sme_pc.cidr_block}" = "${data.aws_vpc_peering_connection.sme_pc.id}"
    "10.11.113.128/26"                                     = "pcx-03f83d9773966a9ed"
  }

  vpc_private_subnets = {
    us-east-1a = "10.120.0.0/24"
    us-east-1b = "10.120.1.0/24"
  }

  vpc_private_subnet_routes = [
    "10.100.0.0/16",
  ]

  vpc_public_subnets = {
    us-east-1a = "10.120.10.0/24"
    us-east-1b = "10.120.11.0/24"
  }
}

data "aws_iam_role" "vpc_flow_logs_role" {
  name = "prod-redlock-cloudwatch-role"
}

data "aws_cloudwatch_log_group" "vpc_flow_log_group" {
  name = "prod-redlock-log-group"
}

data "aws_s3_bucket" "flow_logs_bucket" {
  bucket = "prod-orcd-vpc-logs"
}

data "aws_ec2_transit_gateway" "networking_transit_gateway" {
  filter {
    name   = "options.amazon-side-asn"
    values = ["64513"]
  }
}

resource "aws_flow_log" "all_logs" {
  iam_role_arn    = data.aws_iam_role.vpc_flow_logs_role.arn
  log_destination = data.aws_cloudwatch_log_group.vpc_flow_log_group.arn
  traffic_type    = "ALL"
  vpc_id          = module.graphql_switchboard_vpc.vpc_id
}

resource "aws_flow_log" "gsirt" {
  vpc_id               = module.graphql_switchboard_vpc.vpc_id
  log_destination      = data.aws_s3_bucket.flow_logs_bucket.arn
  log_destination_type = "s3"
  traffic_type         = "REJECT"

  tags = {
    Name         = "${var.environment}-gsirt"
    service_name = "vpc-flow-log"
    terraformed  = true
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "networking_transit_gateway_attachment" {
  vpc_id             = module.graphql_switchboard_vpc.vpc_id
  subnet_ids         = module.graphql_switchboard_vpc.private_subnet_ids
  transit_gateway_id = data.aws_ec2_transit_gateway.networking_transit_gateway.id
}

data "aws_secretsmanager_secret" "sentry_dsn" {
  name = "${var.environment}/${var.service_name}/SENTRY_DSN"
}

data "aws_secretsmanager_secret_version" "sentry_dsn" {
  secret_id = data.aws_secretsmanager_secret.sentry_dsn.id
}

data "aws_secretsmanager_secret" "auth0_credentials" {
  name = "${var.environment}/${var.service_name}/AUTH0_CREDENTIALS"
}

# Allow service to assume role for cross-account SecretsManager access
data "aws_iam_policy_document" "graphql_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::019963779799:role/ProdOrchardAccess",
    ]
  }
}

resource "aws_iam_policy" "graphql_assume_role_policy" {
  name   = "${var.environment}-${var.service_name}-sts-assume-role-policy"
  policy = data.aws_iam_policy_document.graphql_assume_role_policy.json
}

module "graphql_switchboard_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=1.6.4"

  environment                              = var.environment
  service_name                             = var.service_name
  aws_region                               = var.aws_region
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 512
  task_memory                              = 1024
  maximum_capacity                         = 4
  minimum_capacity                         = 1
  route53_zone_id                          = "Z2RSKZ9M7TJ9Z"
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = module.graphql_switchboard_vpc.vpc_id
  datadog_function_destination_arn         = "arn:aws:lambda:us-east-1:437795906767:function:DatadogLambdaFunction"
  https_listener_certificate_id            = "a76e4883-28aa-4062-a4cc-c06b8012ae28"

  iam_managed_policy_attachments = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "${aws_iam_policy.graphql_assume_role_policy.arn}",
  ]

  fargate_service_subnets = [
    "subnet-077c51b9579e4db4c",
    "subnet-0859bb63ff502c51f",
  ]

  load_balancer_subnets = [
    "subnet-077c51b9579e4db4c",
    "subnet-0859bb63ff502c51f",
  ]

  environment_variables = [
    {
      Environment = "${var.environment}"
    },
    {
      DD_ENV = "${var.environment}-${var.service_name}"
    },
    {
      LOGGER_DSN = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application"
    },
    {
      SENTRY_DSN = "${data.aws_secretsmanager_secret_version.sentry_dsn.secret_string}"
    },
    {
      GRAPHQL_PRODUCT_HOST = "https://${var.environment}-graphql-product.theorchard.io"
    },
    {
      AUTH0_CREDENTIALS_ARN = "${data.aws_secretsmanager_secret.auth0_credentials.arn}"
    },
    {
      AUTH0_AUDIENCE = "${var.auth0_audience}"
    },
    {
      GRASS_URL = "${var.grass_url}"
    },
    {
      SWITCHBOARD_SECRET_ARN = "arn:aws:secretsmanager:us-east-1:019963779799:secret:prod-system-jwt-secret-dIJkPs"
    },
    {
      SWITCHBOARD_ROLE_ARN = "arn:aws:iam::019963779799:role/ProdOrchardAccess"
    },
    {
      INTROSPECTION = "1"
    },
  ]
}

module "graphql_switchboard_service_dashboard" {
  source           = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=2.0.0"
  environment      = var.environment
  environment_type = "fargate"
  service_name     = var.service_name
}