module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/jenkins/pipeline/agents/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Get current account
data "aws_caller_identity" "current" {
}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_ec2_managed_prefix_list" "prefix_lists" {
  for_each = var.prefix_lists_to_allow_ssh
  name     = each.value
}

resource "aws_security_group" "ssh_security_group" {
  name   = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
  vpc_id = data.aws_vpc.vpc.id

  tags = {
    Name           = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
    eiso-exception = "aws.08.30"
  }
}

resource "aws_security_group_rule" "ssh_rule" {
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  type              = "ingress"
  prefix_list_ids   = [for list in data.aws_ec2_managed_prefix_list.prefix_lists : list.id]
  security_group_id = aws_security_group.ssh_security_group.id
}

module "jenkins_agent" {
  source = "git@github.com:theorchard/terraform-jenkins.git//modules/jenkins_agent?ref=5.0.0"

  environment              = var.environment
  aws_stack_name           = "${var.environment}-${var.aws_stack_name}-agent"
  user_data                = module.jenkins_agent_bootstrap.user_data_output
  aws_instance_type        = "m6i.xlarge"
  aws_key_name             = "orchard_admin"
  aws_volume_size          = "500"
  vpc_id                   = data.aws_vpc.vpc.id
  aws_asg_max_size         = 9
  aws_asg_min_size         = 6
  aws_asg_desired_capacity = 6
  # These agents are being replaced by the local-ssd agents below, so all ASG processes are suspended
  asg_suspended_processes  = [
    "HealthCheck",
    "ReplaceUnhealthy",
    "InstanceRefresh",
    "Launch",
    "Terminate",
  ]

  additional_security_group_ids = [
    aws_security_group.ssh_security_group.id
  ]

  vpc_private_subnet_ids = [
    "subnet-5366ef24",
    "subnet-cb4dbae0",
  ]
}

module "jenkins_agent_bootstrap" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=3.3.0"

  chef_role         = "${var.environment}_jenkins_aws_agent"
  aws_instance_name = "${var.environment}-${var.aws_stack_name}-agent"
  aws_iam_role_id   = module.jenkins_agent.aws_iam_role_id_output
}


module "jenkins_agent_local_ssd" {
  source = "git@github.com:theorchard/terraform-jenkins.git//modules/jenkins_agent?ref=7.0.1"

  environment              = var.environment
  aws_stack_name           = "${var.environment}-${var.aws_stack_name}-agent-local-ssd"
  user_data                = module.jenkins_agent_bootstrap_local_ssd.user_data_output
  aws_instance_type        = "m6id.2xlarge"
  aws_key_name             = "orchard_admin"
  aws_volume_size          = "250"
  vpc_id                   = data.aws_vpc.vpc.id
  aws_asg_max_size         = 6
  aws_asg_min_size         = 6
  aws_asg_desired_capacity = 6
  asg_suspended_processes  = var.asg_suspended_processes
  existing_iam_role_name   = "prod-jenkins-aws-pipeline-agent"

  additional_security_group_ids = [
    aws_security_group.ssh_security_group.id
  ]

  vpc_private_subnet_ids = [
    "subnet-5366ef24",
    "subnet-cb4dbae0",
  ]
}

module "jenkins_agent_bootstrap_local_ssd" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=3.3.0"

  chef_role         = "${var.environment}_jenkins_aws_agent_local_ssd"
  aws_instance_name = "${var.environment}-${var.aws_stack_name}-agent-local-ssd"
  aws_iam_role_id   = module.jenkins_agent_local_ssd.aws_iam_role_id_output
}

# Assume role policy document for qa songwhip trusting account role
data "aws_iam_policy_document" "qa_songwhip_jenkins_pipeline_deploy_assume_role_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:iam::619719722105:role/qa-songwhip-jenkins-pipeline-deploy-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

# Assume role policy for qa songwhip trusting account role
resource "aws_iam_policy" "qa_songwhip_jenkins_pipeline_deploy_assume_role_policy" {
  name        = "qa-songwhip-jenkins-pipeline-deploy-role-trusting-policy"
  description = "qa songwhip jenkins pipeline deploy role trusting account policy"
  policy      = data.aws_iam_policy_document.qa_songwhip_jenkins_pipeline_deploy_assume_role_policy_document.json
}

# Attach assume role policy for qa songwhip trusting account role to pipeline agent trusted role
resource "aws_iam_role_policy_attachment" "qa_songwhip_jenkins_pipeline_deploy_assume_role_policy_attachment" {
  role       = module.jenkins_agent.aws_iam_role_id_output
  policy_arn = aws_iam_policy.qa_songwhip_jenkins_pipeline_deploy_assume_role_policy.arn
}

# Allow Jenkins to assume qa-ows-coda-jenkins-secrets-role for reading build secrets
data "aws_iam_policy_document" "qa_ows_coda_jenkins_secrets_assume_role_policy_document" {
  statement {
    effect = "Allow"
    resources = [
      "arn:aws:iam::989790945997:role/qa-ows-coda-jenkins-secrets-role"
    ]
    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_policy" "qa_ows_coda_jenkins_secrets_assume_role_policy" {
  name        = "qa-ows-coda-jenkins-secrets-role-trusting-policy"
  description = "Allow Jenkins to assume qa-ows-coda-jenkins-secrets-role for build secrets"
  policy      = data.aws_iam_policy_document.qa_ows_coda_jenkins_secrets_assume_role_policy_document.json
}

resource "aws_iam_role_policy_attachment" "qa_ows_coda_jenkins_secrets_assume_role_policy_attachment" {
  role       = module.jenkins_agent.aws_iam_role_id_output
  policy_arn = aws_iam_policy.qa_ows_coda_jenkins_secrets_assume_role_policy.arn
}

resource "aws_iam_role_policy_attachment" "qa_ows_coda_jenkins_secrets_assume_role_policy_attachment_local_ssd" {
  role       = module.jenkins_agent_local_ssd.aws_iam_role_id_output
  policy_arn = aws_iam_policy.qa_ows_coda_jenkins_secrets_assume_role_policy.arn
}