module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.application_family
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-permissions-platform-terraform-state"
    key     = "qa/pdp-backfill/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "m2m_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.4"

  environment = var.environment
}

data "aws_iam_policy" "s3_read_only_policy" {
  name = "S3-${var.environment}-${var.bucket_name}-read-only"
}

module "sentry_pdp_backfill" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=4.1.2"

  environment        = var.environment
  platform           = "python"
  service_name       = var.service_name
  application_family = var.application_family
}

module "fargate_worker" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.5.2"

  providers = {
    aws.dns = aws
  }

  application_family        = var.application_family
  environment               = var.environment
  service_name              = var.service_name
  aws_region                = var.aws_region
  task_type                 = "worker"
  container_port            = "9000"
  desired_task_count        = 0
  minimum_capacity          = 0
  maximum_capacity          = 0
  task_cpu                  = 1024
  task_memory               = 2048
  vpc_id                    = module.vpc_info.vpc_id
  fargate_service_subnets   = module.vpc_info.default_private_subnet_ids
  health_check_mode         = "CMD-SHELL"
  health_check_command_list = ["exit", "0"] # Pending a functional pdp-backfill cli command
  iam_managed_policy_attachments = [
    data.aws_iam_policy.s3_read_only_policy.arn,
  ]

  worker_run_task_role_principals = [
    # Defined in ../eventbridge/main.tf
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/Eventbridge-${var.environment}-${var.service_name}",
    # Used by the Prod->QA DynamoDB Refresh Step Function
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/qa-pp-dynamodb-refresh-sfn-role",
    # Allows PP engineers to test/run locally
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/permissions-platform-role",
    # Jenkins scheduler can run the task
    "arn:aws:iam::437795906767:role/prod-jenkins-aws-task-agent",
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      DATADOG_ENV = "${var.environment}-${var.service_name}"
    },
    {
      DD_LOGS_INJECTION = "true"
    },
    {
      SENTRY_DSN = module.sentry_pdp_backfill.sentry_key_dsn_public_output
    }
  ]


  docker_volumes = [
    {
      name = "${var.environment}-${var.service_name}"
      type = "BIND_MOUNT"
    }
  ]

  docker_volume_mount_points = [
    {
      source_volume  = "${var.environment}-${var.service_name}"
      container_path = var.volume_mount_container_path
    }
  ]
}

module "pdp_backfill_service_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.12.0"

  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  healthy_tasks_monitor_enabled     = false
  application_family                = var.application_family
  notification_endpoints            = var.team_slack
  escalation_notification_endpoints = var.team_slack
  teams                             = [var.application_family]
}