module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
}

provider "aws" {
  region = "us-east-1"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/jenkins/scheduler/agents/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_vpc" "vpc" {
  tags = {
    Name = var.vpc_name
  }
}

data "aws_ec2_managed_prefix_list" "prefix_lists" {
  for_each = var.prefix_lists_to_allow_ssh
  name     = each.value
}

resource "aws_security_group" "ssh_security_group" {
  name   = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
  vpc_id = data.aws_vpc.vpc.id

  tags = {
    Name           = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
    eiso-exception = "aws.08.30"
  }
}

resource "aws_security_group_rule" "ssh_rule" {
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  type              = "ingress"
  prefix_list_ids   = [for list in data.aws_ec2_managed_prefix_list.prefix_lists : list.id]
  security_group_id = aws_security_group.ssh_security_group.id
}

module "jenkins_agent" {
  source = "git@github.com:theorchard/terraform-jenkins.git//modules/jenkins_agent?ref=5.0.0"

  environment              = var.environment
  aws_stack_name           = "${var.environment}-${var.aws_stack_name}-agent"
  user_data                = module.jenkins_agent_bootstrap.user_data_output
  aws_instance_type        = "m6i.xlarge"
  aws_key_name             = "orchard_admin"
  aws_volume_size          = "100"
  vpc_id                   = data.aws_vpc.vpc.id
  aws_asg_max_size         = 3
  aws_asg_min_size         = 3
  aws_asg_desired_capacity = 3
  asg_suspended_processes  = var.asg_suspended_processes

  additional_security_group_ids = [
    aws_security_group.ssh_security_group.id
  ]

  vpc_private_subnet_ids = [
    "subnet-5366ef24",
    "subnet-cb4dbae0",
  ]
}

module "jenkins_agent_bootstrap" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=3.3.0"

  chef_role         = "${var.environment}_jenkins_aws_task_agent"
  aws_instance_name = "${var.environment}-${var.aws_stack_name}-agent"
  aws_iam_role_id   = module.jenkins_agent.aws_iam_role_id_output
}