module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = "abacus"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "qa-accounting-terraform-state"
    key     = "qa/royalty_accounting/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_route53_zone" "route53_zone" {
  provider = aws.networking

  name         = "theorchard.io."
  private_zone = false
}

module "qa_services_info" {
  source       = "git@github.com:theorchard/terraform-service-info.git//?ref=1.1.0"
  for_each     = toset(local.external_qa_services)
  environment  = var.environment
  service_name = each.value
}

module "prod_services_info" {
  source       = "git@github.com:theorchard/terraform-service-info.git//?ref=1.1.0"
  for_each     = toset(local.external_prod_services)
  environment  = "prod"
  service_name = each.value
}

module "qa_lambda_info" {
  source              = "git@github.com:theorchard/terraform-service-info.git//?ref=1.1.0"
  for_each            = toset(local.external_qa_lambdas)
  environment         = var.environment
  security_group_type = "lambda"
  service_name        = each.value
}

module "prod_lambda_info" {
  source              = "git@github.com:theorchard/terraform-service-info.git//?ref=1.1.0"
  for_each            = toset(local.external_prod_lambdas)
  environment         = "prod"
  security_group_type = "lambda"
  service_name        = each.value
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map/?ref=3.1.0"
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment        = var.environment
  service_name       = "royalty_accounting"
  secret_name        = each.value
  application_family = var.application_family
}

resource "aws_rds_cluster_parameter_group" "cluster_parameter_group" {
  name        = "${var.environment}-${var.service_name}-mysql8-cluster-parameter-group"
  family      = "aurora-mysql8.0"
  description = "${var.environment}-${var.service_name}-mysql8-cluster-parameter-group"

  parameter {
    apply_method = "pending-reboot"
    name         = "binlog_format"
    value        = "ROW"
  }

  parameter {
    apply_method = "immediate"
    name         = "log_bin_trust_function_creators"
    value        = "1"
  }
}

module "royalty_accounting_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=8.0.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                               = var.environment
  service_name                              = var.service_name
  application_family                        = var.application_family
  rds_engine                                = "aurora-mysql"
  rds_engine_version                        = "8.0"
  rds_cluster_instance_class                = "db.r6g.large"
  rds_cluster_instance_count                = "1"
  rds_master_username                       = "ows_master"
  rds_master_password                       = "ReplaceThisWithASecurePassword123!"
  rds_availability_zones                    = ["us-east-1a", "us-east-1c"]
  rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.cluster_parameter_group.name
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_performance_insights_enabled          = true
  route53_record_creation_enabled           = true
  additional_tags                           = var.additional_tags
  custom_kms_key_enabled                    = true
  rds_ingress_prefix_list_names             = ["shared-orcd-jump-box-private-subnet-prefix-list"]
  rds_ingress_security_groups = flatten([
    [for service in module.qa_services_info : service.security_groups],
    [for service in module.prod_services_info : service.security_groups],
    [for lambda in module.qa_lambda_info : lambda.security_groups],
    [for lambda in module.prod_lambda_info : lambda.security_groups],
    ["437795906767/sg-0e41f4041a085153a"], # prod-jenkins-aws-pipeline-agent-local-ssd
    ["437795906767/sg-0df41dd1eb6264c41"], # playwright-tests
    ["sg-0779e6c7b7261d799"],              # fivetran-rds-proxy
  ])
  vpc_id            = module.vpc_info.vpc_id
  rds_db_subnet_ids = module.vpc_info.default_private_subnet_ids
  account_ids       = [module.aws_accounts.all_accounts["prod"]]
}

resource "aws_route53_record" "royalty_accounting_rds_cname_networking" {
  provider = aws.networking

  zone_id = data.aws_route53_zone.route53_zone.zone_id
  name    = "qa-db-royalty-accounting"
  type    = "CNAME"
  ttl     = "300"
  records = [module.royalty_accounting_rds.rds_cluster_endpoint]
}