locals {
  txmgr_secret_names = {
    txmgr_misc_secrets = "${var.environment}/AOMA/txmgr_misc_secrets"
    txmgr_usm_token    = "${var.environment}/AOMA/txmgr_usm_token"
    txmgr_usm          = "${var.environment}/AOMA/txmgr_usm"
    txmgr_usm_service  = "${var.environment}/AOMA/txmgr_usm_service"
  }

  txmgr_read_secret_keys = [
    "txmgr_misc_secrets",
    "txmgr_usm_token",
    "txmgr_usm",
    "txmgr_usm_service"
  ]

  txmgr_update_secret_keys = [
    "txmgr_usm_token",
    "txmgr_usm_service"
  ]
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region
  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"
  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "dev-aoma-core-terraform-state"
    key     = "dev/aoma-s/usm-token-refresher-service/terraform.tfstate"
    region  = "eu-central-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_secretsmanager_secret" "txmgr" {
  for_each = local.txmgr_secret_names
  name     = each.value
}

data "aws_iam_policy_document" "txmgr_usm_token_secrets_manager_policy_rw" {
  statement {
    actions = [
      "secretsmanager:GetSecretValue"
    ]

    resources = [
      for key in local.txmgr_read_secret_keys : data.aws_secretsmanager_secret.txmgr[key].arn
    ]
  }

  statement {
    actions = [
      "secretsmanager:PutSecretValue",
      "secretsmanager:UpdateSecret"
    ]

    resources = [
      for key in local.txmgr_update_secret_keys : data.aws_secretsmanager_secret.txmgr[key].arn
    ]
  }
}

resource "aws_iam_policy" "txmgr_usm_token_secrets_manager_policy_rw" {
  name   = "Secretsmanager-${var.environment}-${var.service_name}-policy-rw"
  policy = data.aws_iam_policy_document.txmgr_usm_token_secrets_manager_policy_rw.json

  tags = {
    terraformed        = true
    application_family = var.application_family
  }
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_subnets" "fargate_service_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:Name"
    values = var.fargate_subnet_names
  }
}

module "fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.6.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                           = var.environment
  service_name                          = var.service_name
  application_family                    = var.application_family
  non_ecr_image                         = "086679231553.dkr.ecr.us-east-1.amazonaws.com/usm-token-refresher-service:9dd45fcc68a5ba9ab667cf0ff0fdc7d877237776"
  health_check_path                     = "/"
  aws_region                            = var.aws_region
  commit_sha                            = "stage"
  container_port                        = var.container_port
  task_type                             = "worker"
  desired_task_count                    = var.desired_task_count
  task_cpu                              = var.task_cpu
  task_memory                           = var.task_memory
  maximum_capacity                      = var.maximum_capacity
  minimum_capacity                      = var.minimum_capacity
  vpc_id                                = data.aws_vpc.vpc.id
  permissions_boundary_enabled          = false
  splitio_enabled                       = false
  ows_machine_to_machine_enabled        = false
  fargate_service_subnets               = data.aws_subnets.fargate_service_subnets.ids
  autoscaling_cpu_policy_enabled        = false
  autoscaling_memory_policy_enabled     = false
  cloudwatch_event_enabled              = true
  cloudwatch_event_schedule             = "rate(25 minutes)"

  iam_managed_policy_attachments = [
    aws_iam_policy.txmgr_usm_token_secrets_manager_policy_rw.arn
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      ENVIRONMENT_TYPE = var.environment_type
    },
    {
      JOB_TYPE = var.job_type
    },
    {
      SERVICE_NAME = var.service_name
    }
  ]
}

module "fargate_service_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"

  environment                       = var.environment
  environment_type                  = var.environment_type
  service_name                      = var.service_name
  application_family                = var.application_family
  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.notification_endpoints
  teams                             = [var.team_name]
  healthy_tasks_monitor_enabled     = false
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  service_cpu_monitor_enabled       = false
}