provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "backup-orcd-terraform-state"
    key     = "prod/route53-backup/fargate/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}


module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

module "route53_backup_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.2.0"

  providers = {
    aws.dns = aws
  }

  environment                        = var.environment
  service_name                       = var.service_name
  aws_region                         = var.aws_region
  application_family                 = var.application_family
  task_type                          = "worker"
  health_check_command               = "pgrep python"
  deployment_minimum_healthy_percent = "100"
  autoscaling_cpu_policy_enabled     = false
  autoscaling_memory_policy_enabled  = false
  stopped_task_monitoring_enabled    = true
  desired_task_count                 = 0
  minimum_capacity                   = 0
  maximum_capacity                   = 0
  task_cpu                           = 2048
  task_memory                        = 4096
  container_port                     = 8080
  health_check_grace_period_seconds  = 300
  target_deregistration_delay        = 300
  vpc_id                             = module.vpc_info.vpc_id
  fargate_service_subnets            = module.vpc_info.default_private_subnet_ids
  iam_managed_policy_attachments = [
    aws_iam_policy.route53_backup_fargate_task_policy.arn
  ]

  environment_variables = [
    {
      ENVIRONMENT = var.environment
    },
    {
      ACCOUNT_ID_TO_BACKUP = var.account_id_to_backup
    },
    {
      SENTRY_DSN = module.sentry_project.sentry_key_dsn_public_output
    },
  ]
  secrets = [
    {
      DD_API_KEY = "${var.environment}/datadog/DD_API_KEY"
    },
    {
      DD_APP_KEY = "${var.environment}/datadog/DD_APP_KEY"
    },
  ]
}

data "aws_iam_policy_document" "route53_backup_fargate_task_policy" {
  statement {
    effect = "Allow"

    actions = ["sts:AssumeRole"]

    resources = [
      "arn:aws:iam::*:role/route53-backup-role",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
      "s3:PutObject"
    ]

    resources = [
      "arn:aws:s3:::backup-route53-backup",
      "arn:aws:s3:::backup-route53-backup/*"
    ]
  }
}

resource "aws_iam_policy" "route53_backup_fargate_task_policy" {
  name   = "${var.service_name}-S3-RW"
  policy = data.aws_iam_policy_document.route53_backup_fargate_task_policy.json
}

module "sentry_project" {
  source             = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"
  service_name       = var.service_name
  application_family = var.application_family
  environment        = var.environment
  teams              = [var.environment]
  platform           = "python"
}