data "aws_caller_identity" "current" {}

data "aws_ec2_managed_prefix_list" "additional_prefix_lists" {
    for_each = toset(local.additional_prefix_lists)

    name = each.value
}

data "aws_acm_certificate" "theorchard_io" {
  domain   = "*.theorchard.io"
  statuses = ["ISSUED"]
}

resource "aws_security_group" "ows_url_shortener_internal_lb_sg" {
  name        = "${var.environment}-${var.service_name}-internal-load-balancer-security-group"
  description = "Allow inbound HTTPS traffic"
  vpc_id      = module.vpc_info.vpc_id

  tags = module.default_tags.tags
}

resource "aws_security_group_rule" "allow_https_inbound" {

  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "TCP"
  prefix_list_ids   = [for prefix_list in local.additional_prefix_lists: data.aws_ec2_managed_prefix_list.additional_prefix_lists[prefix_list].id]
  security_group_id = aws_security_group.ows_url_shortener_internal_lb_sg.id
}

resource "aws_security_group_rule" "allow_outbound_access_to_task" {
  type                     = "egress"
  from_port                = 8080
  to_port                  = 8080
  protocol                 = "TCP"
  source_security_group_id = module.ows_url_shortener_fargate_environment.fargate_security_group_id
  security_group_id        = aws_security_group.ows_url_shortener_internal_lb_sg.id
}

resource "aws_security_group_rule" "allow_inbound_from_internal_load_balancer" {
  type                     = "ingress"
  from_port                = 8080
  to_port                  = 8080
  protocol                 = "TCP"
  source_security_group_id = aws_security_group.ows_url_shortener_internal_lb_sg.id
  security_group_id        = module.ows_url_shortener_fargate_environment.fargate_security_group_id
}

resource "aws_lb" "ows_url_shortener_internal_lb" {
  name                        = "${var.environment}-${var.service_name}-internal"
  internal                    = true
  load_balancer_type          = "application"
  subnets                     = module.vpc_info.default_private_subnet_ids
  security_groups             = [aws_security_group.ows_url_shortener_internal_lb_sg.id]
  enable_deletion_protection  = false

  access_logs {
    enabled = true
    bucket  = "shared-orcd-lb-logs"
    prefix  = "${data.aws_caller_identity.current.account_id}.${var.environment}-fansifter-${var.service_name}"
  }

  tags = module.default_tags.tags
}

resource "aws_lb_target_group" "ows_url_shortener_internal_tg" {
  # checkov:skip=CKV_AWS_378:Ensure AWS Load Balancer doesn't use HTTP protocol
  name                  = "${var.environment}-${var.service_name}-internal"
  port                  = 8080
  protocol              = "HTTP"
  vpc_id                = module.vpc_info.vpc_id
  target_type           = "ip"
  deregistration_delay  = 60

  health_check {
    path                = "/hello/"
    interval            = 10
    timeout             = 5
    healthy_threshold   = 3
    unhealthy_threshold = 3
    matcher             = "200"
  }

  stickiness {
    enabled = false
    type    = "lb_cookie"
  }

  tags = module.default_tags.tags
}

resource "aws_lb_listener" "ows_url_shortener_internal_listener" {
  load_balancer_arn = aws_lb.ows_url_shortener_internal_lb.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-3-2021-06"
  certificate_arn   = data.aws_acm_certificate.theorchard_io.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.ows_url_shortener_internal_tg.arn
  }

}

resource "aws_route53_record" "load_balancer_route53_record" {
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  name    = "${var.environment}-${var.service_name}.${var.domain_name}"
  type    = "A"

  alias {
    name                   = aws_lb.ows_url_shortener_internal_lb.dns_name
    zone_id                = aws_lb.ows_url_shortener_internal_lb.zone_id
    evaluate_target_health = true
  }
}


resource "aws_route53_record" "theorchard_io_load_balancer_route53_record" {
  provider = aws.networking

  zone_id = data.aws_route53_zone.theorchard_io_route53_zone.zone_id
  name    = "${var.environment}-${var.service_name}.theorchard.io"
  type    = "A"

  alias {
    name                   = aws_lb.ows_url_shortener_internal_lb.dns_name
    zone_id                = aws_lb.ows_url_shortener_internal_lb.zone_id
    evaluate_target_health = true
  }
}