data "aws_s3_bucket" "logging_bucket_lb" {
  bucket = "${var.environment}-orcd-lb-logs"
}

module "chef_server_storage" {
  source = "git@github.com:theorchard/terraform-efs.git//?ref=3.1.0"

  providers = {
    aws.dns = aws
  }

  for_each = var.chef_server_persistent_directories

  environment              = var.environment
  service_name             = "${var.service_name}-${each.key}"
  application_family       = var.application_family
  vpc_id                   = module.vpc_info.vpc_id
  subnet_ids               = module.vpc_info.default_private_subnet_ids
  zone_id                  = data.aws_route53_zone.route53_zone.zone_id
  owner_gid                = "0"
  owner_uid                = "0"
  access_point_permissions = "755"
  efs_throughput_mode      = "elastic"

  efs_ingress_additional_cidr_blocks = [
    "192.168.32.0/24",
  ]
}
resource "aws_security_group_rule" "allow_chef_server_to_access_efs" {
  for_each = var.chef_server_persistent_directories

  from_port                = 2049
  to_port                  = 2049
  protocol                 = "tcp"
  security_group_id        = module.chef_server_storage[each.key].efs_security_group_id_output
  source_security_group_id = module.fargate_environment.fargate_security_group_id
  type                     = "ingress"
}

module "fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.8.0"

  providers = {
    aws.dns = aws
  }

  environment                              = var.environment
  service_name                             = var.service_name
  application_family                       = var.application_family
  aws_region                               = var.aws_region
  ows_machine_to_machine_enabled           = false
  splitio_enabled                          = false
  desired_task_count                       = 1
  task_cpu                                 = 4096
  task_memory                              = 8192
  load_balancer_access_logs_s3_bucket_name = data.aws_s3_bucket.logging_bucket_lb.id
  load_balancer_subnets                    = module.vpc_info.default_private_subnet_ids
  fargate_service_subnets                  = module.vpc_info.default_private_subnet_ids
  health_check_path                        = "/"
  vpc_id                                   = module.vpc_info.vpc_id
  route53_zone_id                          = data.aws_route53_zone.route53_zone.zone_id
  autoscaling_cpu_policy_enabled           = false
  minimum_capacity                         = 1
  maximum_capacity                         = 1
  container_port                           = "80"
  health_check_grace_period_seconds        = 300
  container_start_period_seconds           = 300
  non_ecr_image                            = "086679231553.dkr.ecr.us-east-1.amazonaws.com/chef-server:latest"

  iam_managed_policy_attachments = concat(
    [for k, v in var.chef_server_persistent_directories : module.chef_server_storage[k].efs_iam_policy_arn_output],
    [
      aws_iam_policy.s3_secrets_read_write_policy.arn,
    ]
  )

  docker_volumes = [for k, v in var.chef_server_persistent_directories :
    {
      name            = "${var.environment}-${var.service_name}-${k}"
      file_system_id  = module.chef_server_storage[k].efs_file_system_id_output
      access_point_id = module.chef_server_storage[k].efs_access_point_id_output
    }
  ]

  docker_volume_mount_points = [for k, v in var.chef_server_persistent_directories :
    {
      source_volume  = "${var.environment}-${var.service_name}-${k}"
      container_path = v.dir
    }
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      CHEF_SERVER_NAME = "${var.environment}-${var.service_name}"
    },
    {
      COOKBOOK_STORAGE_BUCKET = module.cookbook_storage_bucket.s3_bucket_name_output
    },
    {
      COOKBOOK_STORAGE_BUCKET_REGION = var.aws_region
    },
    {
      FQDN = module.fargate_environment.non_prod_fargate_service_route53_record_fqdn_output
    },
    {
      OPENSEARCH_URL = "https://${module.opensearch.aws_elasticsearch_endpoint_output}"
    },
    {
      OPENSEARCH_USER = "chef_server"
    },
    {
      POSTGRES_HOST = module.rds.rds_cluster_endpoint
    },
    {
      POSTGRES_PORT = module.rds.rds_cluster_port
    },
    {
      POSTGRES_USER = "chef_server"
    },
    {
      SECRETS_BUCKET = module.secrets_bucket.s3_bucket_name_output
    },
  ]

  secrets = [for secret in var.secrets_manager_secret_names : {
    (secret) = "${var.environment}/${var.service_name}/${secret}"
  }]
}