# General settings.
variable "aws_region" {
  description = "AWS region."
  type        = string
  default     = "us-east-1"
}

variable "environment" {
  description = "Available values: dev, qa, prod."
  type        = string
  default     = "dev"
}

variable "service_name" {
  description = "Service name for resources."
  type        = string
  default     = "break-glass"
}

variable "application_family" {
  description = "Application family to which this project belongs."
  type        = string
  default     = "devops"
}

variable "acm_certificate_domain" {
  description = "Certificate Manager certificate domain."
  type        = string
  default     = "*.dev.theorchard.io"
}

variable "route53_dns_zone" {
  description = "Route53 DNS zone name."
  type        = string
  default     = "dev.theorchard.io"
}

variable "vpc_name" {
  description = "VPC name to deploy resources."
  type        = string
  default     = "dev"
}

variable "load_balancer_access_logs_bucket_name" {
  description = "ELB access-logs bucket name."
  type        = string
  default     = "dev-orchard-elb-logs"
}

variable "trusted_cidr_blocks" {
  description = "List of CIDR blocks to allow access from."
  type        = list(string)
  default = [
    "10.10.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
  ]
}

# Load-Balancer settings.
variable "load_balancer_ssl_policy" {
  description = "SSL policy to be applied to the ALB HTTPS listener."
  type        = string
  default     = "ELBSecurityPolicy-FS-1-2-2019-08"
}

variable "load_balancer_session_timeout" {
  description = "OIDC session timeout in seconds."
  type        = number
  default     = 300
}

variable "load_balancer_azure_client_id" {
  description = "ALB Azure OIDC application client ID."
  type        = string
  #default     = "0oavq4m3gltW7j8eU0x7" # okta
  default = "ea9e2143-5179-428b-a453-039eb79dc683" # Azure
}

variable "load_balancer_azure_client_secret" {
  description = "ALB Azure OIDC application client secret."
  type        = string
  default     = "dummy"
}

# Lambda settings.
variable "elevate_permissions_lambda_name" {
  description = "Name of the Lambda function that grants elevated permissions."
  type        = string
  default     = "elevate-permissions"
}

variable "elevate_permissions_secrets_manager_secret_names" {
  description = "List of secrets for elevate-permissions Lambda."
  type        = list(string)
  default = [
    "JIRA_API_TOKEN",
    "SLACK_TOKEN",
  ]
}

variable "email_sender_domain" {
  description = "Verified email domain of sender for elevate_permissions lambda"
  default     = "dev.theorchard.io"
}

variable "email_sender" {
  description = "Email address of sender for elevate_permissions lambda"
  default     = "donotreply@dev.theorchard.io"
}

variable "cleanup_lambda_name" {
  description = "Name of the Lambda function that detaches and removes expired IAM Policies."
  type        = string
  default     = "cleanup"
}

variable "cleanup_lambda_invocation_schedule" {
  description = "CloudWatch Events invocation schedule for the cleanup Lambda."
  type        = string
  default     = "rate(1 hour)"
}

variable "audit_lambda_name" {
  description = "Name of the Lambda function that generates audit logs and attaches to Jira."
  type        = string
  default     = "audit"
}

variable "audit_lambda_invocation_schedule" {
  description = "CloudWatch Events invocation schedule for the audit Lambda."
  type        = string
  default     = "rate(1 hour)"
}

variable "audit_secrets_manager_secret_names" {
  description = "List of secrets for audit Lambda."
  type        = list(string)
  default = [
    "JIRA_API_TOKEN",
  ]
}

variable "home_page_lambda_name" {
  description = "Name of the Lambda function that generates home page HTML."
  type        = string
  default     = "home-page"
}

variable "lambda_function_timeout" {
  description = "Function execution timeout in seconds."
  type        = number
  default     = 300
}

variable "lambda_datadog_notification_endpoints" {
  description = "DataDog notification endpoints for Lambda functions."
  type        = string
  default     = "@slack-monitoring"
}

# IAM settings.
variable "role_session_duration" {
  description = "Session duration in seconds for break-glass role."
  type        = number
  default     = 7200
}

variable "role_policies" {
  description = "List of existing IAM policies attached to break-glass role."
  type        = list(string)
  default = [
    "dev-orchard-shared-iam-access-policy",
    "dev-orchard-shared-iam-deny-policy",
    "dev-orchard-shared-read-policy",
    "dev-orchard-shared-write-policy",
  ]
}

variable "policy_prefix" {
  description = "Prefix for Lambda managed IAM Policies that allow to assume break-glass role."
  type        = string
  default     = "BreakGlass-"
}

locals {
  load_balancer_name                                  = "${var.environment}-${var.service_name}"
  load_balancer_security_group_name                   = "${var.environment}-${var.service_name}-alb-security-group"
  load_balancer_elevate_permissions_target_group_name = "${var.environment}-${var.service_name}-elevate-perms"
  load_balancer_home_page_target_group_name           = "${var.environment}-${var.service_name}-home-page"
  load_balancer_route53_record_name                   = "${local.load_balancer_name}.${var.route53_dns_zone}"
  load_balancer_index_page_content                    = file("alb-index-template.html")

  break_glass_role_name                          = "${var.environment}-${var.service_name}-access-role"
  break_glass_validate_role_name                 = "${var.environment}-${var.service_name}-validate-role"
  break_glass_elevate_permissions_policy_name    = "${var.environment}-${var.service_name}-elevate-permissions-access-policy"
  break_glass_restrict_direct_access_policy_name = "${var.environment}-${var.service_name}-restrict-direct-access-policy"

  lambda_security_group_name             = "${var.environment}-${var.service_name}-lambda-security-group"
  elevate_permissions_lambda_name        = "${var.service_name}-${var.elevate_permissions_lambda_name}"
  elevate_permissions_lambda_policy_name = "${var.environment}-${var.service_name}-${var.elevate_permissions_lambda_name}-lambda-policy"
  cleanup_lambda_name                    = "${var.service_name}-${var.cleanup_lambda_name}"
  cleanup_lambda_policy_name             = "${var.environment}-${var.service_name}-${var.cleanup_lambda_name}-lambda-policy"
  audit_lambda_name                      = "${var.service_name}-${var.audit_lambda_name}"
  audit_lambda_policy_name               = "${var.environment}-${var.service_name}-${var.audit_lambda_name}-lambda-policy"
  home_page_lambda_name                  = "${var.service_name}-${var.home_page_lambda_name}"
  home_page_lambda_policy_name           = "${var.environment}-${var.service_name}-${var.home_page_lambda_name}-lambda-policy"

  sqs_queue_name = "${var.service_name}-communication"

  okta_group_name = "Okta-local-${var.environment}-${var.service_name}"

  subnet_ids = { for subnet in data.aws_subnet.private_subnet_details : subnet.availability_zone => subnet.id if subnet.available_ip_address_count > 32 }

  tags = {
    environment        = var.environment
    application_family = var.application_family
    project            = var.service_name
    jira_ticket        = "DEVEX-361"
    terraformed        = true
  }
}