module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/abacus-managed-airflow/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [module.vpc_info.vpc_id]
  }
  filter {
    name   = "tag:Name"
    values = ["*private*"]
  }
}

data "aws_subnet" "private_subnet" {
  for_each = toset(data.aws_subnets.private_subnets.ids)
  id       = each.value
}

module "aws_accounts" {
  source = "git@github.com:theorchard/terraform-aws-accounts-map.git//modules/read_accounts_map?ref=3.1.0"
}

module "ows_abacus_state_owsrequest" {
  source = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"

  environment_name = var.environment
  service_name     = var.service_name
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
  application_family = var.application_family
}


#############################################
########### Abacus airflow 2.9.2 ############
#############################################
module "abacus_airflow_environment" {
  source                    = "git@github.com:theorchard/terraform-airflow.git//?ref=3.0.1"
  environment               = var.environment
  service_name              = "abacus-airflow"
  application_family        = var.application_family
  airflow_version           = "2.9.2"
  airflow_environment_class = var.environment_class
  airflow_log_enabled       = true
  airflow_log_level         = "INFO"
  bucket_name               = module.prod_abacus_airflow_s3_bucket.s3_bucket_name_output
  airflow_create_iam_policies_for_roles_web_auth = [
    "Admin",
  ]
  airflow_configuration_options = {
    "core.default_task_retries"                = 0
    "core.parallelism"                         = 10000
    "webserver.default_ui_timezone"            = "America/New_York"
    "webserver.show_trigger_form_if_no_params" = true
    "celery.worker_autoscale"                  = "5,5"
    "metrics.metrics_use_pattern_match"        = true
    "custom.ows_env"                           = var.environment
    "custom.ar_mysql_db_host"                  = var.ar_mysql_db_host
    "custom.ar_mysql_db_user"                  = var.ar_mysql_db_user
    "custom.ar_mysql_connection_name"          = var.ar_mysql_connection_name
    "custom.snowflake_connection_name"         = var.snowflake_connection_name
    "custom.snowflake_user"                    = var.snowflake_user
    "custom.snowflake_account"                 = var.snowflake_account
    "custom.snowflake_database"                = var.snowflake_database
    "custom.snowflake_schema"                  = var.snowflake_schema
    "custom.snowflake_warehouse"               = var.snowflake_warehouse
    "custom.snowflake_role"                    = var.snowflake_role
    "custom.s3_adjustments_bucket_name"        = var.s3_adjustments_bucket_name
    "custom.s3_payments_bucket_name"           = var.s3_payments_bucket_name
    "custom.s3_sales_bucket_name"              = var.s3_sales_bucket_name
    "custom.s3_static_data_bucket_name"        = var.s3_static_data_bucket_name
    "custom.extract_sales_dag_execution_role"  = var.extract_sales_dag_execution_role
    "secrets.backend"                          = var.secrets_backend
    "secrets.backend_kwargs"                   = jsonencode({ "connections_prefix" = "${var.environment}/abacus-airflow" })
  }
  vpc_id         = module.vpc_info.vpc_id
  vpc_subnet_ids = ["subnet-cb4dbae0", "subnet-098b89d0c58c5693a"]
  https_listener_allow_cidr_blocks = concat(
    var.https_listener_allow_cidr_blocks,
    [for subnet in data.aws_subnet.private_subnet : subnet.cidr_block]
  )

  airflow_external_policies_to_attach = [
    aws_iam_policy.abacus_airflow_sales_buckets_read_write_policy.name,
    aws_iam_policy.abacus_airflow_secrets_manager_policy.name,
    aws_iam_policy.abacus_managed_airflow_policy.name,
    module.ows_abacus_state_owsrequest.policy_name_output,
    module.prod_abacus_airflow_s3_bucket.s3_read_only_policy_name_output,
    data.aws_iam_policy.abacus_airflow_invoke_lambda_policy.name,
    aws_iam_policy.abacus_airflow_assume_role_policy.name,
  ]

  providers = {
    aws.dns = aws.networking
  }
}

module "abacus_airflow_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = "abacus-airflow"
  secret_name        = each.value
}