variable "aws_region" {}
variable "environment" {}
variable "service_name" {}
variable "auth0_audience" {}

provider "aws" {
  region = "${var.aws_region}"
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/graphql-switchboard/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_ec2_managed_prefix_list" "vpn_ny" {
  filter {
    name   = "prefix-list-name"
    values = ["vpn-ny"]
  }
}

data "aws_ec2_transit_gateway" "transit_gateway" {
  filter {
    name   = "options.amazon-side-asn"
    values = ["64513"]
  }
}

module "graphql_switchboard_vpc" {
  source = "../modules/vpc"

  environment        = "${var.environment}"
  service_name       = "${var.service_name}"
  aws_region         = "${var.aws_region}"
  transit_gateway_id = data.aws_ec2_transit_gateway.transit_gateway.id

  vpc_peering_routes = {
    "10.12.240.0/24" = "pcx-081e15090e7473f33"
    "10.12.250.0/24" = "pcx-0af1f7d5294ddbcb2"
  }

  vpc_cidr_block = "10.110.0.0/16"

  vpc_private_subnets = {
    us-east-1a = "10.110.0.0/24"
    us-east-1b = "10.110.1.0/24"
  }

  vpc_private_subnet_routes = [
    "10.100.0.0/16",
  ]

  vpc_private_subnet_prefix_list_routes = [
    data.aws_ec2_managed_prefix_list.vpn_ny.id,
  ]

  vpc_public_subnets = {
    us-east-1a = "10.110.10.0/24"
    us-east-1b = "10.110.11.0/24"
  }

  vpc_public_subnet_prefix_list_routes = [
    data.aws_ec2_managed_prefix_list.vpn_ny.id,
  ]
}

data "aws_iam_role" "vpc_flow_logs_role" {
  name = "prod-redlock-cloudwatch-role"
}

data "aws_cloudwatch_log_group" "vpc_flow_log_group" {
  name = "prod-redlock-log-group"
}

data "aws_s3_bucket" "flow_logs_bucket" {
  bucket = "prod-orcd-vpc-logs"
}

data "aws_ec2_transit_gateway" "networking_transit_gateway" {
  filter {
    name   = "options.amazon-side-asn"
    values = ["64513"]
  }
}

resource "aws_flow_log" "all_logs" {
  iam_role_arn    = data.aws_iam_role.vpc_flow_logs_role.arn
  log_destination = data.aws_cloudwatch_log_group.vpc_flow_log_group.arn
  traffic_type    = "ALL"
  vpc_id          = module.graphql_switchboard_vpc.vpc_id
}

resource "aws_flow_log" "gsirt" {
  vpc_id               = module.graphql_switchboard_vpc.vpc_id
  log_destination      = data.aws_s3_bucket.flow_logs_bucket.arn
  log_destination_type = "s3"
  traffic_type         = "REJECT"

  tags = {
    Name         = "${var.environment}-gsirt"
    service_name = "vpc-flow-log"
    terraformed  = true
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "networking_transit_gateway_attachment" {
  vpc_id             = module.graphql_switchboard_vpc.vpc_id
  subnet_ids         = module.graphql_switchboard_vpc.private_subnet_ids
  transit_gateway_id = data.aws_ec2_transit_gateway.networking_transit_gateway.id
}

data "aws_secretsmanager_secret" "sentry_dsn" {
  name = "${var.environment}/${var.service_name}/SENTRY_DSN"
}

data "aws_secretsmanager_secret_version" "sentry_dsn" {
  secret_id = "${data.aws_secretsmanager_secret.sentry_dsn.id}"
}

data "aws_secretsmanager_secret" "auth0_credentials" {
  name = "${var.environment}/${var.service_name}/AUTH0_CREDENTIALS"
}

# Allow service to assume role for cross-account SecretsManager access
data "aws_iam_policy_document" "graphql_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::662302927201:role/qa-orchard-access",
    ]
  }
}

resource "aws_iam_policy" "graphql_assume_role_policy" {
  name   = "${var.environment}-${var.service_name}-sts-assume-role-policy"
  policy = "${data.aws_iam_policy_document.graphql_assume_role_policy.json}"
}

module "graphql_switchboard_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=1.6.4"
  providers = {
    aws = aws
  }

  environment                              = "${var.environment}"
  service_name                             = "${var.service_name}"
  aws_region                               = "${var.aws_region}"
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 512
  task_memory                              = 1024
  maximum_capacity                         = 4
  minimum_capacity                         = 1
  route53_zone_id                          = "Z2RSKZ9M7TJ9Z"
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = "${module.graphql_switchboard_vpc.vpc_id}"
  datadog_function_destination_arn         = "arn:aws:lambda:us-east-1:437795906767:function:DatadogLambdaFunction"
  https_listener_certificate_id            = "a76e4883-28aa-4062-a4cc-c06b8012ae28"
  qa_https_listener_allow_cidr_blocks = [
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "10.12.240.0/24",
    "10.12.250.0/24",
  ]


  iam_managed_policy_attachments = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    "${aws_iam_policy.graphql_assume_role_policy.arn}",
  ]

  fargate_service_subnets = module.graphql_switchboard_vpc.private_subnet_ids

  load_balancer_subnets = module.graphql_switchboard_vpc.private_subnet_ids

  environment_variables = [
    {
      Environment = "${var.environment}"
    },
    {
      DD_ENV = "${var.environment}-${var.service_name}"
    },
    {
      LOGGER_DSN = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application"
    },
    {
      SENTRY_DSN = "${data.aws_secretsmanager_secret_version.sentry_dsn.secret_string}"
    },
    {
      SWITCHBOARD_ROLE_ARN = "arn:aws:iam::662302927201:role/qa-orchard-access"
    },
    {
      SWITCHBOARD_SECRET_ARN = "arn:aws:secretsmanager:us-east-1:662302927201:secret:qa-system-jwt-secret-FH9GOn"
    },
    {
      GRAPHQL_PRODUCT_HOST = "https://${var.environment}-graphql-product.theorchard.io"
    },
    {
      AUTH0_CREDENTIALS_ARN = "${data.aws_secretsmanager_secret.auth0_credentials.arn}"
    },
    {
      AUTH0_AUDIENCE = "${var.auth0_audience}"
    },
    {
      GRASS_URL = "https://${var.environment}-ows-grass.theorchard.io"
    },
    {
      INTROSPECTION = "1"
    },
  ]
}

module "graphql_switchboard_service_dashboard" {
  source                      = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=2.0.0"
  environment                 = "${var.environment}"
  environment_type            = "fargate"
  service_name                = "${var.service_name}"
  notification_endpoints      = "@slack-monitoring @slack-switchboard-eng"
  service_4xx_monitor_enabled = false
}