module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/direct-delivery/aurora/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "cloudflare_zone" "cloudflare_cloudflare_zone" {
  name = var.cloudflare_domain_name
}

resource "cloudflare_record" "dddb_cloudflare_record" {
  zone_id = data.cloudflare_zone.cloudflare_cloudflare_zone.id
  name    = "dd-db"
  ttl     = 60
  content = module.direct_delivery_rds_cluster.rds_cluster_endpoint
  type    = "CNAME"
  proxied = false
}

resource "cloudflare_record" "reportsdd02_cloudflare_record" {
  zone_id = data.cloudflare_zone.cloudflare_cloudflare_zone.id
  name    = "reportsdd02"
  ttl     = 60
  content = module.direct_delivery_rds_cluster.rds_cluster_reader_endpoint
  type    = "CNAME"
  proxied = false
}

data "aws_route53_zone" "route53_zone" {
  name = var.route53_zone
}

module "direct_delivery_rds_cluster" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.6.0"

  providers = {
    aws.dns = aws.networking
  }

  application_family                        = var.application_family
  environment                               = var.env
  service_name                              = "${var.service_name}-cluster"
  rds_engine_version                        = "8.0.mysql_aurora.3.08.2"
  rds_cluster_instance_class                = "db.r7g.2xlarge"
  rds_cluster_instance_class_secondary      = "db.r7g.2xlarge"
  rds_cluster_instance_count                = var.rds_instance_count
  rds_db_subnet_group_name                  = "prod-orchard-private-subnet-group"
  rds_master_username                       = "direct_delivery_master"
  rds_master_password                       = "dummy_password"
  rds_proxy_enabled                         = true
  rds_proxy_secrets                         = [for secret in module.secrets : secret.secret_arn]
  rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.direct_delivery_mysql8_cluster_parameter_group.name
  rds_cluster_instance_parameter_group_name = aws_db_parameter_group.direct_delivery_mysql8_parameter_group.name
  vpc_id                                    = module.vpc_info.vpc_id
  route53_zone_id                           = data.aws_route53_zone.route53_zone.zone_id
  rds_backup_retention_period               = "35"
  enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]
  rds_ingress_cidr_blocks = [
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "10.10.40.0/22",
    "10.141.0.0/29",
    "10.100.72.0/21",
    "10.100.112.0/21",
    "10.100.88.0/21",
  ]
}

module "secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}