data "aws_availability_zones" "azs" {
  exclude_zone_ids = ["use1-az3"]
}

data "aws_subnets" "private_subnets_debian_13" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:tier"
    values = ["private"]
  }

  filter {
    name   = "availability-zone-id"
    values = data.aws_availability_zones.azs.zone_ids
  }
}


data "aws_instances" "neo4j_cluster_debian_13" {
  instance_tags = {
    Name = "${var.environment}-${var.service_name_debian_13}"
  }
}

module "neo4j_debian_13_environment" {
  source = "git@github.com:theorchard/terraform-neo4j-cluster.git//debian?ref=1.1.0"

  environment             = var.environment
  service_name            = var.service_name_debian_13
  vpc_id                  = data.aws_vpc.vpc.id
  vpc_private_subnet_ids  = data.aws_subnets.private_subnets_debian_13.ids
  data_volume_device_name = "/dev/sdb"
  data_volume_device_type = "gp3"
  data_volume_iops        = 10000
  data_volume_size        = 6000
  data_volume_throughput  = 781
  # it can't go any faster than that due to instance type limitations
  ssh_keypair_name                  = "dev_orchard_admin"
  route53_zone_id                   = "Z21XEY26C989RH"
  dbms_backup_s3_bucket             = "dev-orchdbucket"
  data_volume_delete_on_termination = true
  aws_instance_type                 = "r8gb.xlarge"
  user_data                         = module.chef_bootstrap_neo4j_debian_13.user_data_output

  ami_id           = data.aws_ami.debian_13_arm64.id
  desired_capacity = 3
  min_size         = 3
  max_size         = 3
}

data "aws_ami" "debian_13_arm64" {
  most_recent = true

  owners = ["086679231553"]

  filter {
    name   = "name"
    values = ["debian-13-arm64-*"]
  }
}


resource "aws_security_group_rule" "allow_shared_jenkins_nodes_ssh_debian_13" {
  type      = "ingress"
  from_port = 22
  to_port   = 22
  protocol  = "TCP"
  prefix_list_ids = [
    data.aws_ec2_managed_prefix_list.shared_account_prefix_list.id,
    data.aws_ec2_managed_prefix_list.vpn_sme_internal_primary.id
  ]
  security_group_id = module.neo4j_debian_13_environment.instance_security_group_id_output
}

resource "aws_security_group_rule" "allow_shared_jenkins_nodes_neo4j_debian_13" {
  type      = "ingress"
  from_port = 7687
  to_port   = 7687
  protocol  = "TCP"
  prefix_list_ids = [
    data.aws_ec2_managed_prefix_list.shared_account_prefix_list.id,
    data.aws_ec2_managed_prefix_list.vpn_sme_internal_primary.id
  ]
  security_group_id = module.neo4j_debian_13_environment.instance_security_group_id_output
}

module "chef_bootstrap_neo4j_debian_13" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git//?ref=4.0.1"

  chef_role                    = "dev_neo4j_debian_13_cluster"
  chef_environment             = var.environment
  aws_iam_role_id              = module.neo4j_debian_13_environment.instance_iam_role_name_output
  aws_instance_name            = "${var.environment}-${var.service_name_debian_13}"
  ebs_data_mount_point         = "/var/lib/neo4j"
  block_device_filesystem_type = "xfs"
}


resource "aws_iam_role_policy_attachment" "neo4j_dev_refresh_policy_attachment_debian_13" {
  role       = module.neo4j_debian_13_environment.instance_iam_role_name_output
  policy_arn = aws_iam_policy.neo4j_dev_refresh_policy.arn
}

resource "aws_route53_record" "dev_route53_record_debian_13" {
  # This is here to cover the canonical cluster url pre 4.x upgrade
  name    = "dev-neo4j-cluster-debian-13"
  zone_id = var.route53_zone_id
  type    = "A"
  ttl     = var.route53_record_ttl
  records = [
    "10.101.2.35",
  ]

  # Allow DNS record updates via lifecycle hooks without Terraform trying to change things.
  lifecycle {
    ignore_changes = [
      records
    ]
  }
}

resource "aws_route53_record" "non_production_route53_record_debian_13" {
  # This is here to cover the canonical cluster url pre 4.x upgrade
  name    = "dev-neo4j-5-cluster-debian-13"
  zone_id = var.route53_zone_id
  type    = "A"
  ttl     = var.route53_record_ttl
  records = [
    "10.101.2.35",
  ]

  # Allow DNS record updates via lifecycle hooks without Terraform trying to change things.
  lifecycle {
    ignore_changes = [
      records
    ]
  }
}

resource "aws_route53_record" "cluster_discovery_debian_13" {
  name    = "dev-neo4j-5-cluster-debian-13-discovery"
  zone_id = var.route53_zone_id
  type    = "A"
  ttl     = var.route53_record_ttl
  records = [
    "10.101.2.35",
  ]

  # Allow DNS record updates via lifecycle hooks without Terraform trying to change things.
  lifecycle {
    ignore_changes = [
      records
    ]
  }
}

# Allow Dev cluster to read Prod S3 backup location to pull backups
data "aws_iam_policy_document" "access_prod_backup_debian_13" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::437795906767:role/dev-neo4j-cluster-access-prod-neo4j-cluster-backups-role",
    ]
  }
}


resource "aws_iam_role_policy_attachment" "access_prod_backup_policy_attachment_debian_13" {
  role       = module.neo4j_debian_13_environment.instance_iam_role_name_output
  policy_arn = aws_iam_policy.access_prod_backup_policy.arn
}

resource "aws_iam_role_policy_attachment" "dev_restore_policy_attachment_debian_13" {
  role       = module.neo4j_debian_13_environment.instance_iam_role_name_output
  policy_arn = data.aws_iam_policy.neo4j_cluster_restore_policy.arn
}

data "aws_iam_policy" "neo4j_cluster_restore_policy" {
  name = "SecretsManager-${var.environment}-neo4j-cluster-restore-policy"
}


# Datadog monitors and dashboards
module "datadog_neo4j_dashboards_and_monitors_debian_13" {
  source                     = "git@github.com:theorchard/terraform-datadog.git//modules/neo4j?ref=6.17.1"
  environment                = var.environment
  service_name               = var.service_name_debian_13
  neo4j_major_version_number = 5
  neo4j_monitors_enabled     = false
}

module "neo4j_user_debian_13" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.neo4j_user_secrets_manager)

  environment        = var.environment
  service_name       = var.service_name_debian_13
  secret_name        = each.value
  application_family = var.application_family
}