module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-eom-terraform-state"
    key     = "dev/dra/dra-dispatcher-service/terraform.tfstate"
    region  = "eu-central-1"
    encrypt = true
  }
}

data "aws_wafv2_web_acl" "waf" {
  name  = "IOCACL"
  scope = "REGIONAL"
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_subnets" "fargate_service_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:Name"
    values = var.fargate_subnet_names
  }
}

data "aws_subnets" "lb_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  filter {
    name   = "tag:Name"
    values = var.lb_subnet_names
  }
}



module "dra_dispatcher_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.5.0"

  providers = {
    aws.dns = aws
  }

  environment                              = var.environment
  service_name                             = var.service_name
  application_family                       = var.application_family
  non_ecr_image                            = "718729873097.dkr.ecr.eu-central-1.amazonaws.com/dsc-dra-ms-hierdispatcher"
  health_check_path                        = "/health"
  aws_region                               = var.aws_region
  commit_sha                               = "latest"
  container_port                           = var.container_port
  task_type                                = "web_service"
  desired_task_count                       = var.desired_task_count
  task_cpu                                 = var.task_cpu
  task_memory                              = var.task_memory
  maximum_capacity                         = var.maximum_capacity
  minimum_capacity                         = var.minimum_capacity
  vpc_id                                   = data.aws_vpc.vpc.id
  custom_waf_arn                           = data.aws_wafv2_web_acl.waf.arn
  permissions_boundary_enabled             = false
  https_listener_domain_for_certificate    = "*.medigitalapps.com"
  splitio_enabled                          = false
  ows_machine_to_machine_enabled           = false
  fargate_service_subnets                  = data.aws_subnets.fargate_service_subnets.ids
  load_balancer_subnets                    = data.aws_subnets.lb_subnets.ids
  route53_record_creation_enabled          = false
  enable_centralized_alb_logs              = false
  load_balancer_access_logs_s3_bucket_name = "shared-orcd-lb-logs-eu-central-1"

  secrets = [for secret in var.secrets_manager_secret_names : {
    (secret) = "${var.environment}/${var.service_name}/${secret}"
  }]

  environment_variables = [
    { SPRING_PROFILES_ACTIVE = var.spring_profiles_active },
    { JAVA_TOOL_OPTIONS = var.java_tool_options },
    { KAFKA_BOOTSTRAP_SERVERS = var.kafka_bootstrap_servers },
    { KAFKA_TOPIC_CLEARANCE = var.kafka_topic_clearance },
    { LOGGING_LEVEL_HIERDISPATCHER = var.logging_level_hierdispatcher },
    { LOGGING_LEVEL_KAFKA = var.logging_level_kafka }
  ]

  iam_managed_policy_attachments = [
    aws_iam_policy.ses_policy.arn,
    aws_iam_policy.msk_cluster_policy.arn, 
    aws_iam_policy.msk_topic_policy.arn,
    aws_iam_policy.msk_consumer_group_policy.arn
  ]

}

module "fargate_service_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"

  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  application_family                = var.application_family
  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.notification_endpoints
}

module "secrets_manager" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}


#IAM Policies

data "aws_sesv2_email_identity" "ses_sender" {
  email_identity = "sonymusic.com"
}

data "aws_iam_policy_document" "ses_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ses:SendEmail",
      "ses:SendRawEmail"
    ]
    resources = [
      data.aws_sesv2_email_identity.ses_sender.arn
    ]
  }
}

resource "aws_iam_policy" "ses_policy" {
  name   = "SES-${var.environment}-${var.service_name}-send-email"
  policy = data.aws_iam_policy_document.ses_policy_document.json
}


data "aws_msk_cluster" "msk_cluster_identity" {
  cluster_name = var.msk_cluster_name
}

data "aws_iam_policy_document" "msk_topic_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:DescribeTopic",
      "kafka-cluster:ReadData"
    ]

    resources = [
      "${replace(data.aws_msk_cluster.msk_cluster_identity.arn, ":cluster/", ":topic/")}/${var.topic_name}"
    ]
  }
}

data "aws_iam_policy_document" "msk_cluster_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "kafka-cluster:Connect"
    ]

    resources = [
      data.aws_msk_cluster.msk_cluster_identity.arn
    ]
  }
}

resource "aws_iam_policy" "msk_cluster_policy" {
  name   = "MSK-${var.environment}-${var.service_name}-connect"
  policy = data.aws_iam_policy_document.msk_cluster_policy_document.json
}

resource "aws_iam_policy" "msk_topic_policy" {
  name   = "MSK-${var.environment}-${var.service_name}-RO"
  policy = data.aws_iam_policy_document.msk_topic_policy_document.json
}


data "aws_iam_policy_document" "msk_consumer_group_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "kafka-cluster:DescribeGroup",
      "kafka-cluster:AlterGroup"
    ]

    resources = [
      "${replace(data.aws_msk_cluster.msk_cluster_identity.arn, ":cluster/", ":group/")}/${var.consumer_group_name}"      
    ]
  }
}

resource "aws_iam_policy" "msk_consumer_group_policy" {
  name   = "MSK-${var.environment}-${var.service_name}-consumer-group"
  policy = data.aws_iam_policy_document.msk_consumer_group_policy_document.json
}