module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_kms_key" "kms_key" {
  key_id = "alias/backup_orcd-github-repo-backup-kms-key"
}

resource "aws_iam_policy" "github_backup_ecs_policy" {
  name   = "${var.service_name}-ecs-policy"
  policy = data.aws_iam_policy_document.github_backup_ecs_policy_document.json
  tags   = local.tags
}

data "aws_iam_policy_document" "github_backup_ecs_policy_document" {

  statement {
    effect = "Allow"

    actions = [
      "s3:AbortMultipartUpload",
      "s3:PutObject"
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "kms:Decrypt",
      "kms:GenerateDataKey"
    ]

    resources = [
      data.aws_kms_key.kms_key.arn
    ]
  }
}


module "secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment        = var.environment
  service_name       = var.service_name
  secret_name        = "GITHUB_TOKEN"
  application_family = var.application_family
}

module "github_backup_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.2.0"

  providers = {
    aws.dns = aws
  }

  environment                        = var.environment
  service_name                       = var.service_name
  aws_region                         = var.aws_region
  application_family                 = var.application_family
  task_type                          = "worker"
  health_check_command               = "pgrep python"
  deployment_minimum_healthy_percent = "100"
  autoscaling_cpu_policy_enabled     = false
  autoscaling_memory_policy_enabled  = false
  stopped_task_monitoring_enabled    = true
  desired_task_count                 = 0
  minimum_capacity                   = 0
  maximum_capacity                   = 1
  task_cpu                           = 2048
  task_memory                        = 4096
  container_port                     = 8080
  health_check_grace_period_seconds  = 300
  container_start_period_seconds     = 300
  target_deregistration_delay        = 300
  cloudwatch_event_enabled           = true
  cloudwatch_event_schedule          = "rate(1 day)"
  vpc_id                             = module.vpc_info.vpc_id
  fargate_service_subnets            = module.vpc_info.default_private_subnet_ids
  iam_managed_policy_attachments = [
    aws_iam_policy.github_backup_ecs_policy.arn
  ]

  environment_variables = [
    {
      ENVIRONMENT = var.environment
    },
    {
      S3_BUCKET_NAME = module.s3_bucket.s3_bucket_name_output
    },
    {
      GITHUB_URL = var.github_url
    },
    {
      GITHUB_ORGANIZATION = var.github_organization
    },
    {
      KMS_KEY_ID = data.aws_kms_key.kms_key.id
    },
    {
      SENTRY_DSN = module.sentry_project.sentry_key_dsn_public_output
    }
  ]
}


module "sentry_project" {
  source                       = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"
  service_name                 = var.service_name
  application_family           = var.application_family
  environment                  = var.environment
  teams                        = [var.environment]
  platform                     = "python"
}

module "fargate_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.15.2"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  service_cpu_monitor_silenced      = true
  healthy_tasks_monitor_silenced    = true
  notification_endpoints            = "@slack-devops"
  escalation_notification_endpoints = "@slack-devops"
  application_family                = var.application_family

  successful_tasks_monitor_enabled = true
  # Query over 25 hours rather than 24 to allow for backups running at slightly different times each day
  successful_tasks_query_interval = "last_25h"
}