# Look up the internal ALB created by the Fargate module
data "aws_lb" "internal_alb" {
  name = "${var.environment}-${var.service_name}"
}

# Prefix list for Orchard private subnets (used for PrivateLink ingress)
data "aws_ec2_managed_prefix_list" "orchard_prod_private" {
  name = "prod-orcd-private-subnet-prefix-list"
}

# NLB security group with PrivateLink enforcement
resource "aws_security_group" "email_campaigns_nlb_sg" {
  name        = "${var.environment}-${var.service_name}-nlb-sg"
  description = "Security group for email-campaigns NLB with PrivateLink"
  vpc_id      = module.vpc_info.vpc_id

  tags = merge(
    module.default_tags.tags,
    {
      Name = "${var.environment}-${var.service_name}-nlb-sg"
    }
  )
}

resource "aws_vpc_security_group_ingress_rule" "nlb_from_orchard" {
  security_group_id = aws_security_group.email_campaigns_nlb_sg.id
  description       = "Allow HTTPS from Orchard private subnets via PrivateLink"
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
  prefix_list_id    = data.aws_ec2_managed_prefix_list.orchard_prod_private.id
}

resource "aws_vpc_security_group_egress_rule" "nlb_to_alb" {
  security_group_id            = aws_security_group.email_campaigns_nlb_sg.id
  description                  = "Allow HTTPS to internal ALB"
  from_port                    = 443
  to_port                      = 443
  ip_protocol                  = "tcp"
  referenced_security_group_id = module.ows_service_fargate_environment.fargate_load_balancer_security_group_id
}

# Allow NLB health checks and traffic to reach the internal ALB
resource "aws_security_group_rule" "alb_from_nlb" {
  description              = "Allow HTTPS from NLB to internal ALB"
  type                     = "ingress"
  from_port                = 443
  to_port                  = 443
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.email_campaigns_nlb_sg.id
  security_group_id        = module.ows_service_fargate_environment.fargate_load_balancer_security_group_id
}

# NLB for cross-account PrivateLink access
# Traffic flow: Orchard VPC Endpoint -> PrivateLink -> this NLB -> ALB -> Fargate
resource "aws_lb" "email_campaigns_nlb" {
  name               = "${var.environment}-${var.service_name}-nlb"
  internal           = true
  load_balancer_type = "network"
  subnets            = module.vpc_info.default_private_subnet_ids
  security_groups    = [aws_security_group.email_campaigns_nlb_sg.id]

  enforce_security_group_inbound_rules_on_private_link_traffic = "on"

  enable_deletion_protection       = false
  enable_cross_zone_load_balancing = true

  access_logs {
    enabled = true
    bucket  = "shared-orcd-lb-logs"
    prefix  = "${data.aws_caller_identity.current.account_id}/${var.environment}-fansifter-${var.service_name}-nlb"
  }

  tags = merge(
    module.default_tags.tags,
    {
      Name = "${var.environment}-${var.service_name}-nlb"
    }
  )
}

# Target group pointing to the internal ALB
resource "aws_lb_target_group" "email_campaigns_nlb_tg" {
  name        = "${var.environment}-${var.service_name}-nlb-tg"
  port        = 443
  protocol    = "TCP"
  target_type = "alb"
  vpc_id      = module.vpc_info.vpc_id

  health_check {
    enabled             = true
    healthy_threshold   = 3
    interval            = 30
    protocol            = "HTTPS"
    path                = "/hello/"
    matcher             = "200"
    unhealthy_threshold = 3
  }

  tags = merge(
    module.default_tags.tags,
    {
      Name = "${var.environment}-${var.service_name}-nlb-tg"
    }
  )
}

# Attach the internal ALB to the target group
resource "aws_lb_target_group_attachment" "email_campaigns_alb" {
  target_group_arn = aws_lb_target_group.email_campaigns_nlb_tg.arn
  target_id        = data.aws_lb.internal_alb.arn
  port             = 443
}

# NLB listener forwarding to the ALB target group
resource "aws_lb_listener" "email_campaigns_nlb_listener" {
  load_balancer_arn = aws_lb.email_campaigns_nlb.arn
  port              = 443
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.email_campaigns_nlb_tg.arn
  }
}

# VPC Endpoint Service for cross-account PrivateLink access
resource "aws_vpc_endpoint_service" "email_campaigns" {
  acceptance_required        = true
  network_load_balancer_arns = [aws_lb.email_campaigns_nlb.arn]
  allowed_principals         = ["arn:aws:iam::${var.orchard_aws_account_id}:root"]
}