module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/dns/theorchard.io/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

resource "aws_route53_zone" "main" {
  # checkov:skip=CKV2_AWS_38: Suppressed for now because enabling DNSSEC signing is a non-trivial change
  # checkov:skip=CKV2_AWS_39: Suppressed for now because of potential cost implications of enabling query logging for this domain
  name = var.route53_zone_name

  tags = {
    Name        = var.route53_zone_name
    Description = "R53 zone for ${var.route53_zone_name}"
  }
}

resource "aws_route53_record" "cname_records" {
  for_each = var.cname_records
  zone_id  = aws_route53_zone.main.zone_id
  name     = each.key
  type     = "CNAME"
  ttl      = 300
  records  = each.value.records
}

resource "aws_route53_record" "acm_dns_validation_record" {
  for_each        = var.acm_dns_validation_records
  allow_overwrite = false
  name            = each.key
  records         = each.value.records
  ttl             = 60
  type            = "CNAME"
  zone_id         = aws_route53_zone.main.zone_id
}