module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "dev"
  profile = "dev"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/ows-podcast/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_route53_zone" "route53_zone" {
  name = "${var.environment}.theorchard.io"
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.0.0"

  environment = var.environment
}

module "buckets" {
  source = "../../modules/ows-podcast/buckets"

  environment            = var.environment
  output_bucket_cors     = var.output_assets_bucket_cors
  cloudfront_logs_bucket = "dev-orcd-cloudfront-logs.s3.amazonaws.com"

  output_assets_cdn_certificate_arn = var.output_assets_cdn_certificate_arn
  output_assets_domain              = var.output_assets_domain

  fargate_task_role = ""
  additional_roles  = var.additional_browser_assume_role_arns

  versioning_enabled = false
}

resource "aws_ecr_repository" "ows_repository" {
  name = var.service_name

  encryption_configuration {
    encryption_type = "KMS"
  }

  image_scanning_configuration {
    scan_on_push = true
  }

  force_delete = true
}

# chartable bucket
module "s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.14.1"

  env                = var.environment
  application_family = var.application_family
  bucket_name        = "orcd-podcast-chartable"

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
  
  lifecycle_rules_options_noncurrent_version_transition = [
    {
      prefix = ""
      enabled = true
      days = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]

  lifecycle_rules_options_current_version_transition = [
    {
      prefix = ""
      enabled = true
      days = 180
      storage_class = "DEEP_ARCHIVE"
    }
  ]
}

module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

data "aws_iam_policy_document" "chartable_s3_read_write_policy" {
  statement {
    actions = [
      "s3:*"
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets"
    ]

    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "chartable_s3_read_write_policy" {
  name   = "S3-${module.s3_bucket.s3_bucket_name_output}-RW"
  policy = data.aws_iam_policy_document.chartable_s3_read_write_policy.json
}
# end chartable bucket