module "slaughterhouse_migration_bootstrap" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=4.0.1"

  chef_role         = "${var.environment}_apache_slaughterhouse_server"
  aws_instance_name = "${var.environment}-${var.migration_service_name}"
  aws_iam_role_id   = aws_iam_role.slaughterhouse_role.id
}

resource "aws_instance" "slaughterhouse_migration_instance" {
  # checkov:skip=CKV_AWS_79:deemed not safe to enable, will be silenced globally
  ami                                  = data.aws_ami.debian_12.id
  instance_type                        = "t3.medium"
  key_name                             = var.aws_key_name
  monitoring                           = true
  subnet_id                            = module.vpc_info.default_private_subnet_ids[0]
  vpc_security_group_ids               = [aws_security_group.slaughterhouse_instance_sg.id]
  associate_public_ip_address          = false
  iam_instance_profile                 = aws_iam_instance_profile.slaughterhouse_instance_profile.name
  instance_initiated_shutdown_behavior = "stop"
  ebs_optimized                        = true
  disable_api_termination              = true
  user_data                            = module.slaughterhouse_migration_bootstrap.user_data_output

  root_block_device {
    volume_type           = "gp3"
    volume_size           = 100
    delete_on_termination = false
    encrypted             = true
  }

  volume_tags = merge(module.default_tags.tags, {
    Name         = "${var.environment}-mysql-${var.migration_service_name}"
    map-migrated = var.map_migrated_tag
    service_name = var.migration_service_name
  })

  tags = merge(module.default_tags.tags, {
    Name         = "${var.environment}-mysql-${var.migration_service_name}"
    map-migrated = var.map_migrated_tag
    service_name = var.migration_service_name
  })

  lifecycle {
    ignore_changes = [
      ami,
      subnet_id,
      user_data,
    ]
  }
}

# ALB
resource "aws_lb" "slaughterhouse_migration_lb" {
  name                       = "${var.environment}-${var.migration_lb_name}-lb"
  internal                   = true
  load_balancer_type         = "application"
  enable_deletion_protection = true
  security_groups            = [aws_security_group.slaughterhouse_lb_sg.id]
  subnets                    = slice(module.vpc_info.default_private_subnet_ids, 0, 2)

  access_logs {
    enabled = true
    bucket  = data.aws_s3_bucket.lb_logs_bucket.id
    prefix  = "${data.aws_caller_identity.current.account_id}/${var.environment}-${var.migration_lb_name}-lb"
  }

  lifecycle {
    ignore_changes = [subnets]
  }
}

resource "aws_lb_target_group" "slaughterhouse_migration_target_group" {
  name        = aws_lb.slaughterhouse_migration_lb.name
  port        = 80
  protocol    = "HTTP"
  vpc_id      = module.vpc_info.vpc_id
  target_type = "instance"

  health_check {
    enabled             = true
    healthy_threshold   = 3
    interval            = 10
    matcher             = "200-299,301"
    path                = "/healthchk.html"
    port                = "traffic-port"
    protocol            = "HTTP"
    timeout             = 5
    unhealthy_threshold = 5
  }
}

resource "aws_lb_listener" "slaughterhouse_migration_alb_listener" {
  load_balancer_arn = aws_lb.slaughterhouse_migration_lb.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-3-2021-06"
  certificate_arn   = data.aws_acm_certificate.certificate.arn

  default_action {
    target_group_arn = aws_lb_target_group.slaughterhouse_migration_target_group.arn
    type             = "forward"
  }
}

resource "aws_lb_target_group_attachment" "slaughterhouse_migration_target_group_attachment" {
  target_group_arn = aws_lb_target_group.slaughterhouse_migration_target_group.arn
  target_id        = aws_instance.slaughterhouse_migration_instance.id
  port             = 80
}

# NLB
resource "aws_lb" "slaughterhouse_migration_nlb" {
  name                             = "${var.environment}-${var.migration_lb_name}-nlb"
  internal                         = true
  load_balancer_type               = "network"
  idle_timeout                     = "10"
  enable_deletion_protection       = true
  enable_cross_zone_load_balancing = true
  security_groups                  = [aws_security_group.slaughterhouse_nlb_sg.id]
  subnets                          = slice(module.vpc_info.default_private_subnet_ids, 0, 2)

  access_logs {
    enabled = true
    bucket  = data.aws_s3_bucket.lb_logs_bucket.id
    prefix  = "${data.aws_caller_identity.current.account_id}/${var.environment}-${var.migration_lb_name}-nlb"
  }
}

resource "aws_lb_target_group" "slaughterhouse_migration_sftp_nlb_target_group" {
  name         = "${aws_lb.slaughterhouse_migration_nlb.name}-sftp"
  port         = 22
  protocol     = "TCP"
  target_type  = "instance"
  vpc_id       = module.vpc_info.vpc_id

  health_check {
    port                = "traffic-port"
    protocol            = "TCP"
    healthy_threshold   = "3"
    unhealthy_threshold = "3"
    interval            = "10"
  }
  deregistration_delay = "300"

  depends_on = [aws_lb.slaughterhouse_migration_nlb]
}

resource "aws_lb_listener" "slaughterhouse_migration_sftp_ssh_tcp" {
  load_balancer_arn = aws_lb.slaughterhouse_migration_nlb.id
  port              = "22"
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.slaughterhouse_migration_sftp_nlb_target_group.id
  }
}

resource "aws_lb_target_group_attachment" "slaughterhouse_migration_sftp_nlb_target_group_attachment" {
  target_group_arn = aws_lb_target_group.slaughterhouse_migration_sftp_nlb_target_group.arn
  target_id        = aws_instance.slaughterhouse_migration_instance.id
  port             = 22
}

resource "aws_lb_target_group" "slaughterhouse_migration_webapp_nlb_target_group" {
  name         = "${aws_lb.slaughterhouse_migration_nlb.name}-webapp"
  port         = 443
  protocol     = "TCP"
  target_type  = "alb"
  vpc_id       = module.vpc_info.vpc_id

  health_check {
    port                = "traffic-port"
    matcher             = "200-299,301"
    protocol            = "HTTPS"
    healthy_threshold   = "3"
    unhealthy_threshold = "3"
    interval            = "10"
  }
  deregistration_delay = "300"

  depends_on = [aws_lb.slaughterhouse_migration_nlb]
}

resource "aws_lb_listener" "slaughterhouse_migration_nlb_webapp_listener" {
  load_balancer_arn = aws_lb.slaughterhouse_migration_nlb.id
  port              = "443"
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.slaughterhouse_migration_webapp_nlb_target_group.id
  }
}

resource "aws_lb_target_group_attachment" "slaughterhouse_migration_webapp_nlb_target_group_attachment" {
  target_group_arn = aws_lb_target_group.slaughterhouse_migration_webapp_nlb_target_group.arn
  target_id        = aws_lb.slaughterhouse_migration_lb.id
  port             = 443
}

# WAF — reuse existing ACL, new association for the migration ALB
resource "aws_wafv2_web_acl_association" "migration_lb_waf_association" {
  resource_arn = aws_lb.slaughterhouse_migration_lb.arn
  web_acl_arn  = module.slaughterhouse_custom_waf.waf_blocking_arn_output
}

# DNS
resource "aws_route53_record" "slaughterhouse_migration_lb_dns" {
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  name    = "qa-bacon-migration"
  type    = "A"

  alias {
    name                   = aws_lb.slaughterhouse_migration_nlb.dns_name
    zone_id                = aws_lb.slaughterhouse_migration_nlb.zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "slaughterhouse_migration_sftp_nlb_dns" {
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  name    = "qa-bacon-migration-sftp"
  type    = "A"

  alias {
    name                   = aws_lb.slaughterhouse_migration_nlb.dns_name
    zone_id                = aws_lb.slaughterhouse_migration_nlb.zone_id
    evaluate_target_health = true
  }
}