resource "aws_cloudwatch_log_group" "csa-test" {
  #checkov:skip=CKV_AWS_338: Ensure CloudWatch log groups retains logs for at least 1 year
  name              = "/ecs/csa-test"
  retention_in_days = 7
}

resource "aws_ecs_task_definition" "csa-test" {
  family                   = "${lower(var.vpc_name)}-csa-test-td"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "1024"
  memory                   = "2048"
  execution_role_arn       = "arn:aws:iam::718729873097:role/ecsTaskExecutionRole"
  task_role_arn            = "arn:aws:iam::718729873097:role/csa-task-role"

  container_definitions = jsonencode([
    {
      name      = "csa"
      image     = "718729873097.dkr.ecr.eu-central-1.amazonaws.com/csa:latest"
      essential = true

      portMappings = [{
        containerPort = 8080
        hostPort      = 8080
        protocol      = "tcp"
      }]

      healthCheck = {
        command     = ["CMD-SHELL", "curl -f http://localhost:8080/csa/actuator/health || exit 1"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 60
      }


      environment = [
        { name = "SPRING_PROFILES_ACTIVE", value = "test" },
        { name = "JAVA_TOOL_OPTIONS", value = "-XX:+UseContainerSupport" }
      ]

      secrets = [
      {
        name      = "DB_PASSWORD"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:DB_PASSWORD::"
      },
      {
        name      = "CLIENT_SECRET"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:CLIENT_SECRET::"
      },
      {
        name      = "AOMA_AUTH_PASSWORD"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:AOMA_AUTH_PASSWORD::"
      },
      {
        name      = "AOMA_ATTEMPT_PASSWORD"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:AOMA_ATTEMPT_PASSWORD::"
      },
      {
        name      = "AOMA_STATUS_PASSWORD"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:AOMA_STATUS_PASSWORD::"
      },
      {
        name      = "RDX_CLIENT_SECRET"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/test-u4KJxH:RDX_CLIENT_SECRET::"
      },
      {
        name      = "VAULT_TOKEN"
        valueFrom = "arn:aws:secretsmanager:eu-central-1:718729873097:secret:csa/vault-iGyd8d"
      }
    ]

      logConfiguration = {
        logDriver = "awslogs"
        options = {
          awslogs-region        = var.region
          awslogs-group         = "/ecs/csa-test"
          awslogs-stream-prefix = "ecs"
        }
      }
    }
  ])
}

resource "aws_ecs_service" "csa-test" {
  name                  = "${lower(var.vpc_name)}-csa-test"
  cluster               = "arn:aws:ecs:eu-central-1:718729873097:cluster/csa-cluster"
  task_definition       = aws_ecs_task_definition.csa-test.arn
  desired_count         = 1
  launch_type           = "FARGATE"
  platform_version      = "LATEST"
  enable_execute_command = true
  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent         = 200

  network_configuration {
    subnets         = [aws_subnet.DIGSYS-D3-IAPP-1A.id, aws_subnet.DIGSYS-D3-IAPP-1B.id]
    security_groups = [aws_security_group.DIGSYS-D3-CSA2APP01-SG.id]
    assign_public_ip = false
  }

  load_balancer {
    target_group_arn = aws_lb_target_group.digsys-d3-csa2-test[0].arn
    container_name   = "csa"
    container_port   = 8080
  }

  depends_on = [aws_lb_listener.digsys-d3-csa2-test[0]]

}