module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "dev"
  profile = "dev"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/datadog-agent/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.2"

  environment = var.environment
}

module "datadog_agent_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.3.0"

  providers = {
    aws.dns = aws.dev
  }

  environment                       = var.environment
  service_name                      = var.service_name
  application_family                = var.application_family
  aws_region                        = var.aws_region
  use_custom_task_definition_file   = true
  task_definition_file_location     = file("datadog-agent.json")
  service_platform_version          = "1.4.0"
  desired_task_count                = 1
  minimum_capacity                  = 1
  maximum_capacity                  = 2
  task_cpu                          = 256
  task_memory                       = 512
  container_port                    = 8126
  http_listener_enabled             = true
  http_listener_port                = 8126
  https_listener_enabled            = false
  health_check_grace_period_seconds = 10
  health_check_path                 = "/info"
  blocking_waf_enabled              = true
  custom_waf_arn                    = module.datadog_agent_proxy_waf.waf_blocking_arn_output
  vpc_id                            = module.vpc_info.vpc_id

  https_listener_allow_prefix_list_names = [
  "vpn-ny-users",
  ]

  additional_http_ports = [
    {
      host_port          = 4318
      container_port     = 4318
      http_listener_port = 4318
      protocol           = "tcp"
    }
  ]
}

module "datadog_agent_proxy_waf" {
  source       = "git@github.com:theorchard/terraform-aws-waf.git//?ref=1.5.0"
  environment  = var.environment
  service_name = var.service_name
  aws_region   = var.aws_region

  count_waf_enabled = false
  block_waf_enabled = true

  excluded_rules = [
    "NoUserAgent_HEADER",
    "EC2MetaDataSSRF_BODY",
    "GenericRFI_BODY",
    "SizeRestrictions_BODY",
    "CrossSiteScripting_BODY"
  ]
}