provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "prod-permissions-platform-terraform-state"
    key     = "prod/cerbos/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.4"

  environment = var.environment
}

data "aws_route53_zone" "route53_zone" {
  name = var.domain_name
}

data "aws_s3_bucket" "logging_bucket" {
  bucket = "aws-waf-logs-${var.environment}-${var.account_group}"
}

module "ows_service_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.5.4"

  providers = {
    aws.dns = aws
  }

  additional_docker_labels = {
    "com.datadoghq.ad.check_names" : jsonencode(["openmetrics"]),
    "com.datadoghq.ad.init_configs" : jsonencode([{}]),
    "com.datadoghq.ad.logs" : jsonencode([
      { source : "prod-cerbos", service : "cerbos" }
    ]),
    "com.datadoghq.ad.instances" : jsonencode([
      {
        openmetrics_endpoint : "http://localhost:3592/_cerbos/metrics",
        namespace : "prod/cerbos", metrics : ["cerbos_dev_*", "go_*", "process_*"]
      }
    ]),
  }
  application_family = var.application_family
  aws_region         = var.aws_region
  container_port     = "3592"
  custom_waf_arn     = module.cerbos_waf.waf_blocking_arn_output
  desired_task_count = 8
  environment        = var.environment
  environment_variables = [
    {
      Environment = var.environment
    },
    {
      DD_APM_ENABLED = "true"
    },
    {
      DD_SITE = "datadoghq.com"
    },
    {
      ECS_FARGATE = "true"
    },
    {
      AUDIT_ENABLED = var.cerbos_audit_enabled
    },
    {
      DECISION_LOGS_ENABLED = var.cerbos_decision_logs_enabled
    },
    {
      CERBOS_ADMIN_API_ENABLED = var.cerbos_admin_api_enabled
    },
    {
      CERBOS_PLAYGROUND_ENABLED = var.cerbos_playground_enabled
    },
    {
      CERBOS_WATCH_FOR_CHANGES = var.cerbos_watch_for_changes
    },
    {
      CERBOS_BATCH_SIZE = var.cerbos_batch_size
    },
    {
      CERBOS_LOG_LEVEL = var.cerbos_log_level
    }
  ]
  fargate_service_subnets                  = module.vpc_info.default_private_subnet_ids
  health_check_path                        = var.health_check_path
  health_check_command_list                = var.health_check_command_list
  health_check_mode                        = var.health_check_mode
  https_listener_domain_for_certificate    = "*.${var.domain_name}"
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  load_balancer_subnets                    = module.vpc_info.default_private_subnet_ids
  maximum_capacity                         = 16
  minimum_capacity                         = 8
  route53_zone_id                          = data.aws_route53_zone.route53_zone.zone_id
  service_name                             = var.service_name
  task_cpu                                 = 8192
  task_memory                              = 16384
  task_type                                = "web_service"
  vpc_id                                   = module.vpc_info.vpc_id
}


module "cerbos_fargate_service_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.12.0"

  environment                 = var.environment
  environment_type            = "fargate"
  service_name                = var.service_name
  service_4xx_monitor_enabled = false
  application_family          = var.application_family
  teams                       = [var.application_family]

  notification_endpoints            = "@slack-permissions-platform-alerts"
  escalation_notification_endpoints = "@slack-permissions-platform-alerts"
}

resource "datadog_service_definition_yaml" "dd_cerbos" {
  service_definition = <<EOF
schema-version: v2.1
dd-service: cerbos
team: ${var.application_family}
tags:
  - application_family:${var.application_family}
EOF
}

module "cerbos_waf" {
  source       = "git@github.com:theorchard/terraform-aws-waf.git//?ref=2.0.0"
  environment  = var.environment
  service_name = var.service_name
  aws_region   = var.aws_region

  count_waf_enabled                 = false
  block_waf_enabled                 = true
  gsirt_ip_block_rule_group_enabled = false

  excluded_rules = [
    "SizeRestrictions_BODY",
  ]
}