module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/frontend-seat/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "frontend_seat_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git?ref=5.1.0"

  environment        = var.environment
  platform           = "javascript"
  service_name       = "frontend-seat"
  application_family = var.application_family
  teams              = [var.environment]
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.2.3"

  environment = var.environment
}

resource "aws_acm_certificate" "tls_cert" {
  domain_name               = "${var.service_name}.${var.domain_name}"
  validation_method         = "DNS"

  options {
    certificate_transparency_logging_preference = "ENABLED"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_acm_certificate_validation" "certificate_validation" {
  certificate_arn         = aws_acm_certificate.tls_cert.arn
  validation_record_fqdns = aws_acm_certificate.tls_cert.domain_validation_options[*].resource_record_name
}

module "spa_environment" {
  source = "git@github.com:theorchard/terraform-internal-spa.git//?ref=2.2.1"
  providers = {
    aws.dns = aws
  }

  environment                   = var.environment
  service_name                  = var.service_name
  application_family            = var.application_family
  vpc_id                        = module.vpc_info.vpc_id
  load_balancer_subnet_ids      = slice(module.vpc_info.default_private_subnet_ids, 0, 3)
  fully_qualified_domain_name   = "${var.service_name}.${var.domain_name}"
  certificate_domain            = "${var.service_name}.${var.domain_name}"
  vpc_endpoint_name             = "prod-s3-interface-vpc-endpoint"
  route53_record_enabled        = false
  spa_rewrite_target            = "index-sme.html"
  ingress_prefix_list_names     = ["vpn-sme-internal-primary"]
}

data "aws_security_group" "alb_ingress" {
  for_each = toset([
    "prod-playwright-tests-lambda-security-group",
  ])
  name   = each.key
  vpc_id = module.vpc_info.vpc_id
}

resource "aws_vpc_security_group_ingress_rule" "allow_alb_ingress" {
  for_each                     = data.aws_security_group.alb_ingress
  security_group_id            = module.spa_environment.load_balancer_security_group_id
  referenced_security_group_id = each.value.id
  from_port                    = 443
  to_port                      = 443
  ip_protocol                  = "tcp"
  description                  = "Allow ${each.key} to reach internal seat ALB"

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
  }
}