data "cloudflare_ip_ranges" "cloudflare_ip_ranges" {}

data "aws_wafv2_web_acl" "default_block" {
  name  = "${var.environment}-orcd-waf-block"
  scope = "REGIONAL"
}

resource "aws_security_group" "public_alb_security_group" {
  name        = "${var.environment}-${var.service_name}-public-alb-sg"
  description = "Public ALB security group"
  vpc_id      = module.vpc_info.vpc_id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "TCP"
    cidr_blocks = data.cloudflare_ip_ranges.cloudflare_ip_ranges.ipv4_cidr_blocks
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "TCP"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port       = var.container_port
    to_port         = var.container_port
    protocol        = "tcp"
    security_groups = [module.hot_updater_server_fargate_environment.fargate_security_group_id]
  }

  tags = {
    eiso-exception = "aws.08.30"
  }
}

resource "aws_lb" "public_application_load_balancer" {
  # checkov:skip=CKV2_AWS_20:We do not use HTTP to HTTPS redirect, as this module supports HTTP and HTTPS endpoints independently.

  name                       = "${var.environment}-${var.service_name}-public"
  internal                   = false
  load_balancer_type         = "application"
  idle_timeout               = 60
  security_groups            = [aws_security_group.public_alb_security_group.id]
  subnets                    = module.vpc_info.default_public_subnet_ids
  enable_deletion_protection = false

  access_logs {
    bucket  = "shared-orcd-lb-logs"
    prefix  = "${data.aws_caller_identity.current.account_id}/${var.environment}/${var.service_name}"
    enabled = true
  }
}

resource "aws_wafv2_web_acl_association" "public_alb_waf_association" {
  resource_arn = aws_lb.public_application_load_balancer.arn
  web_acl_arn  = data.aws_wafv2_web_acl.default_block.arn
}

resource "aws_lb_listener" "public_load_balancer_https_listener" {
  load_balancer_arn = aws_lb.public_application_load_balancer.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = data.aws_acm_certificate.qa_mobile_hot_updater_pdestorage_com.arn

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = "Forbidden"
      status_code  = "403"
    }
  }
}

resource "aws_lb_target_group" "public_fargate_target_group" {
  # checkov:skip=CKV_AWS_378:Ensure AWS Load Balancer doesn't use HTTP protocol
  name                 = "${var.environment}-${var.service_name}-pub-target"
  port                 = var.container_port
  protocol             = "HTTP"
  target_type          = "ip"
  deregistration_delay = "60"
  vpc_id               = module.vpc_info.vpc_id

  # Values copied from terraform-fargate module to match main service settings
  health_check {
    enabled             = true
    healthy_threshold   = "3"
    interval            = "10"
    matcher             = "200"
    path                = "/health"
    port                = var.container_port
    protocol            = "HTTP"
    timeout             = "5"
    unhealthy_threshold = "3"
  }

  stickiness {
    type            = "lb_cookie"
    cookie_duration = "86400"
    enabled         = false
  }

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }

  depends_on = [aws_lb.public_application_load_balancer]
}

# We will enable them later.
#
# resource "aws_lb_listener_rule" "hot_updater_rule" {
#   listener_arn = aws_lb_listener.public_load_balancer_https_listener.arn
#   priority     = 100
#
#   action {
#     type             = "forward"
#     target_group_arn = aws_lb_target_group.public_fargate_target_group.arn
#   }
#
#   condition {
#     path_pattern {
#       values = ["/hot-updater/*"]
#     }
#   }
#
#   condition {
#     host_header {
#       values = ["${var.environment}-${var.service_name}-public.${data.aws_route53_zone.route53_zone.name}"]
#     }
#   }
# }
#
# resource "aws_lb_listener_rule" "analytics_rule" {
#   listener_arn = aws_lb_listener.public_load_balancer_https_listener.arn
#   priority     = 200
#
#   action {
#     type             = "forward"
#     target_group_arn = aws_lb_target_group.public_fargate_target_group.arn
#   }
#
#   condition {
#     path_pattern {
#       values = ["/analytics/*"]
#     }
#   }
#
#   condition {
#     host_header {
#       values = ["${var.environment}-${var.service_name}-public.${data.aws_route53_zone.route53_zone.name}"]
#     }
#   }
# }
#
# resource "aws_lb_listener_rule" "admin_rule" {
#   listener_arn = aws_lb_listener.public_load_balancer_https_listener.arn
#   priority     = 300
#
#   action {
#     type             = "forward"
#     target_group_arn = aws_lb_target_group.public_fargate_target_group.arn
#   }
#
#   condition {
#     path_pattern {
#       values = ["/admin/*"]
#     }
#   }
#
#   condition {
#     host_header {
#       values = ["${var.environment}-${var.service_name}-public.${data.aws_route53_zone.route53_zone.name}"]
#     }
#   }
# }

resource "aws_security_group_rule" "allow_inbound_from_public_load_balancer" {
  type                     = "ingress"
  from_port                = var.container_port
  to_port                  = var.container_port
  protocol                 = "TCP"
  source_security_group_id = aws_security_group.public_alb_security_group.id
  security_group_id        = module.hot_updater_server_fargate_environment.fargate_security_group_id
}

resource "aws_route53_record" "dev_public_alb_dns" {
  name    = "${var.environment}-${var.service_name}-public"
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  type    = "CNAME"
  ttl     = "60"
  records = [aws_lb.public_application_load_balancer.dns_name]
}