module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/docker-ssh-proxies/sme-rds-proxy/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_subnets" "private_subnets" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.vpc.id]
  }
  tags = {
    Name = "*private*"
    tier = "private"
  }
}

module "fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.6.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                     = var.environment
  service_name                    = var.service_name
  application_family              = var.application_family
  secrets_manager_service_name    = var.service_name
  non_ecr_image                   = "086679231553.dkr.ecr.${var.aws_region}.amazonaws.com/docker-ssh-proxy:latest"
  aws_region                      = var.aws_region
  commit_sha                      = "latest"
  container_port                  = "2222"
  task_type                       = "worker"
  health_check_command            = "echo 'orcd sme rds proxy'"
  desired_task_count              = 2
  task_cpu                        = 1024
  task_memory                     = 2048
  maximum_capacity                = 2
  minimum_capacity                = 2
  vpc_id                          = data.aws_vpc.vpc.id
  additional_lb_target_group_arns = [aws_lb_target_group.sme_proxy_ecs_nlb_tg.arn]
  splitio_enabled                 = false
  ows_machine_to_machine_enabled  = false

  fargate_service_subnets = data.aws_subnets.private_subnets.ids

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      SERVICE_NAME = var.service_name
    },
    {
      PERMIT_DB_HOST = join(" ", var.rds_instances) # SSHD will only allow connections from these hosts. Each host should be separated by a space.
    },
    {
      PROXY_USER = "sme-rds"
    },
  ]
}

resource "aws_security_group" "sme_proxy_ecs_nlb_sg" {
  name        = "${var.environment}-${var.service_name}-nlb-sg"
  description = "Security group for sme Proxy ECS NLB"
  vpc_id      = data.aws_vpc.vpc.id

  ingress {
    description = "Allow inbound traffic"
    from_port   = 2222
    to_port     = 2222
    protocol    = "tcp"
    cidr_blocks = [
      "192.168.32.0/24",
      "192.168.40.0/22",
      "10.110.0.0/24",
      "10.110.1.0/24",
    ]
  }

  egress {
    description = "Allow all outbound traffic to the VPC"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [
      "0.0.0.0/0",
    ]
  }

  tags = merge(local.tags, {
    eiso-exception = "aws.08.30"
  })
}

resource "aws_security_group_rule" "sme_proxy_task_allow_inbound_from_nlb" {
  type                     = "ingress"
  from_port                = 2222
  to_port                  = 2222
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.sme_proxy_ecs_nlb_sg.id
  security_group_id        = module.fargate_environment.fargate_security_group_id
}

resource "aws_lb" "sme_proxy_ecs_nlb" {
  name               = "${var.environment}-${var.service_name}-nlb"
  internal           = true
  load_balancer_type = "network"
  security_groups    = [aws_security_group.sme_proxy_ecs_nlb_sg.id]
  subnets            = data.aws_subnets.private_subnets.ids

  enable_cross_zone_load_balancing = true

  access_logs {
    enabled = true
    bucket  = "orch-elb-logs"
    prefix  = "${var.environment}-${var.service_name}-nlb"
  }

  tags = local.tags
}

resource "aws_lb_listener" "sme_proxy_ecs_nlb_listener" {
  load_balancer_arn = aws_lb.sme_proxy_ecs_nlb.arn
  port              = 2222
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.sme_proxy_ecs_nlb_tg.arn
  }

  tags = local.tags
}

resource "aws_lb_target_group" "sme_proxy_ecs_nlb_tg" {
  name        = "${var.environment}-${var.service_name}"
  port        = 2222
  protocol    = "TCP"
  vpc_id      = data.aws_vpc.vpc.id
  target_type = "ip"

  health_check {
    healthy_threshold   = 3
    unhealthy_threshold = 3
    interval            = 10
    port                = "traffic-port"
    protocol            = "TCP"
  }

  deregistration_delay = "300"

  tags = local.tags
}

module "fargate_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.13.4"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  application_family                = var.application_family
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  notification_endpoints            = "@slack-devops"
  escalation_notification_endpoints = "@slack-devops"
}

module "sme_rds_proxy_secrets_manager" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.sshd_host_fingerprints_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}