module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
  additional_tags = {
    terraformed = "true"
  }
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/art-relations/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.5.0"

  environment = var.environment
}

data "cloudflare_zone" "cloudflare_cloudflare_zone" {
  name = var.cloudflare_domain_name
}

resource "cloudflare_record" "ardb_cloudflare_record" {
  zone_id = data.cloudflare_zone.cloudflare_cloudflare_zone.id
  name    = "ar-db"
  ttl     = 60
  content = module.art_relations_rds.rds_cluster_endpoint
  type    = "CNAME"
  proxied = false
}

data "aws_route53_zone" "route53_zone" {
  name = var.route53_zone
}

data "aws_route53_zone" "networking_route53_zone" {
  provider = aws.networking
  name     = var.route53_zone
}

data "aws_security_group" "prod-ows-grass-task-security-group" {
  name = "prod-ows-grass-task-security-group"
}

data "aws_security_group" "prod-ows-grass-public-task-security-group" {
  name = "prod-ows-grass-public-task-security-group"
}

module "art_relations_rds" {
  # checkov:skip=CKV_AWS_226:Automatic minor version upgrades are disabled because they result in a failover, and we have mismatched instance types.
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.6.0"

  providers = {
    aws.dns = aws.networking
  }

  application_family                              = var.application_family
  environment                                     = var.env
  service_name                                    = var.service_name
  rds_engine_version                              = "8.0.mysql_aurora.3.08.2"
  # We use a smaller instance type for the reader instance for cost reasons.
  rds_cluster_instance_class                      = "db.r7g.4xlarge"
  rds_cluster_instance_class_secondary            = "db.r7g.4xlarge"
  rds_cluster_instance_count                      = "2"
  rds_db_subnet_group_name                        = "${var.env}-orchard-private-subnet-group"
  rds_master_username                             = "ows_master"
  rds_master_password                             = "dummy123"
  rds_db_cluster_parameter_group_name             = aws_rds_cluster_parameter_group.db_parameter_group_mysql8.name
  rds_cluster_instance_parameter_group_name       = aws_db_parameter_group.db_parameter_group_mysql8.name
  rds_backup_retention_period                     = "35"
  enabled_cloudwatch_logs_exports                 = ["audit", "error", "general"]
  rds_availability_zones                          = ["us-east-1a", "us-east-1c"]
  rds_db_cluster_iam_roles                        = [aws_iam_role.rds_role.arn]
  vpc_id                                          = module.vpc_info.vpc_id
  route53_zone_id                                 = data.aws_route53_zone.route53_zone.zone_id
  networking_route53_zone_id                      = data.aws_route53_zone.networking_route53_zone.id
  rds_ingress_cidr_blocks                         = var.rds_ingress_cidr_blocks
  # Explicitly disable automatic minor version upgrades because they result in a failover, and we have mismatched instance types.
  # Additionally, we desire control over when to apply minor version upgrades, given the potential blast radius of this database.
  rds_cluster_instance_auto_minor_version_upgrade = false
  rds_ingress_security_groups = [
    data.aws_security_group.prod-ows-grass-task-security-group.id,
    data.aws_security_group.prod-ows-grass-public-task-security-group.id,
  ]
  rds_ingress_prefix_list_names = [
    "prod-accounting-private-subnet-prefix-list",
    "vpn-sme-internal-primary",
    "prod-supply-chain-private-subnet-prefix-list",
  ]
  additional_tags                   = var.additional_tags
}