module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = "kdh"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/kafka-infra/akhq/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_acm_certificate" "theorchard_io" {
  domain   = "*.theorchard.io"
  statuses = ["ISSUED"]
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io"
}

module "akhq_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.akhq_secret_names)

  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
  application_family = var.application_family
}

module "akhq_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.3.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                              = var.environment
  application_family                       = var.application_family
  additional_tags                          = var.additional_tags
  service_name                             = var.service_name
  non_ecr_image                            = "086679231553.dkr.ecr.${var.aws_region}.amazonaws.com/${var.service_name}:latest"
  aws_region                               = var.aws_region
  service_platform_version                 = "1.4.0"
  desired_task_count                       = 2
  minimum_capacity                         = 2
  maximum_capacity                         = 4
  task_cpu                                 = 1024
  task_memory                              = 2048
  container_port                           = 8080
  health_check_grace_period_seconds        = 120
  container_start_period_seconds           = 120
  health_check_path                        = "/ui"
  vpc_id                                   = module.vpc_info.vpc_id
  https_listener_certificate_id            = split("/", data.aws_acm_certificate.theorchard_io.arn)[1]
  propagate_tags                           = true

  fargate_service_subnets = module.vpc_info.default_private_subnet_ids

  load_balancer_subnets = module.vpc_info.default_private_subnet_ids

   https_listener_allow_prefix_list_names = [
    "vpn-ny-users",
]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      JVM_OPTS = "-Xms128M -Xmx512M"
    },
    {
      AKHQ_CONFIGURATION = <<-EOT
        akhq:
          connections:
            prod-cdc:
              properties:
                bootstrap.servers: "b-1.prod-managed-kafka-cdc.40dsdw.c6.kafka.us-east-1.amazonaws.com:9094,b-2.prod-managed-kafka-cdc.40dsdw.c6.kafka.us-east-1.amazonaws.com:9094,b-3.prod-managed-kafka-cdc.40dsdw.c6.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL
              schema-registry:
                url: "https://prod-schema-registry.theorchard.io"
                type: confluent
              connect:
                - name: debezium-ar
                  url: "https://prod-kafka-connect-debezium-ar.theorchard.io"
                - name: debezium-ats
                  url: "https://prod-kafka-connect-debezium-ats.theorchard.io"
                - name: debezium-ows-collaborator
                  url: "https://prod-kafka-connect-debezium-cp.theorchard.io"
                - name: debezium-cr
                  url: "https://prod-kafka-connect-debezium-cr.theorchard.io"
                - name: debezium-ot
                  url: "https://prod-kafka-connect-debezium-ot.theorchard.io"
                - name: debezium-ra
                  url: "https://prod-kafka-connect-debezium-ra.theorchard.io"
                - name: kc-ddb-sink-nr-events
                  url: "https://prod-kc-ddb-sink-nr-events.theorchard.io"
                - name: jdbc-snowflake-src-gsr-rel-date
                  url: "https://prod-kc-jdbc-src-gsr-rel-date.theorchard.io"
                - name: jdbc-snowflake-src-released-content
                  url: "https://prod-kc-jdbc-src-released-cont.theorchard.io"
                - name: jdbc-snowflake-src-lp-ai-matching
                  url: "https://prod-kc-jdbc-src-lp-ai-matching.theorchard.io"
                - name: jdbc-snowflake-src-spotify-tracks
                  url: "https://prod-kc-jdbc-src-spotify-tracks.theorchard.io"
                - name: jdbc-snowflake-src-hfr
                  url: "https://prod-kc-jdbc-src-hfr.theorchard.io"
                - name: jdbc-snowflake-src-deleted-hfr
                  url: "https://prod-kc-jdbc-src-deleted-hfr.theorchard.io"
                - name: jdbc-snowflake-src-fr-subacc-sync
                  url: "https://prod-kc-jdbc-src-fr-subacc-sync.theorchard.io"
                - name: jdbc-snowflake-src-fr-track-sync
                  url: "https://prod-kc-jdbc-src-fr-track-sync.theorchard.io"
                - name: jdbc-snowflake-src-fr-vendor-sync
                  url: "https://prod-kc-jdbc-src-fr-vendor-sync.theorchard.io"
                - name: jdbc-sink-mysql-nr
                  url: "https://prod-kafka-connect-jdbc-sink-nr.theorchard.io"
                - name: neo-sink-ama
                  url: "https://prod-kc-neo-cdc-sink-ama.theorchard.io"
                - name: neo-sink-ats
                  url: "https://prod-kc-neo-cdc-sink-ats.theorchard.io"
                - name: neo-sink-cmc
                  url: "https://prod-kc-neo-cdc-sink-cmc.theorchard.io"
                - name: neo-sink-cp
                  url: "https://prod-kc-neo-cdc-sink-cp.theorchard.io"
                - name: neo-sink-spt
                  url: "https://prod-kc-neo-cdc-sink-spt.theorchard.io"
                - name: neo-snk-gsr-rel-date
                  url: "https://prod-kc-neo-cdc-snk-gsr-rel-date.theorchard.io"
                - name: neo-sink-released-ct
                  url: "https://prod-kc-neo-cdc-sink-released-ct.theorchard.io"
                - name: neo-sink-lp-ai-match
                  url: "https://prod-kc-neo-cdc-sink-lp-ai-match.theorchard.io"
                - name: neo-sink-nrgraph
                  url: "https://prod-kc-neo-cdc-sink-nrgraph.theorchard.io"
                - name: neo-src-v5-mg
                  url: "https://prod-kc-neo-v5-src.theorchard.io"
                - name: neo-src-nr
                  url: "https://prod-kc-neo-cdc-src-nr.theorchard.io"
                - name: os-sink-gsr
                  url: "https://prod-kc-os-sink-gsr.theorchard.io"
                - name: os-sink-gp
                  url: "https://prod-kc-os-sink-gp.theorchard.io"
                - name: os-sink-lp
                  url: "https://prod-kc-os-sink-lp.theorchard.io"
                - name: kc-os-sink-product
                  url: "https://prod-kc-os-sink-product.theorchard.io"
                - name: kc-os-sink-track
                  url: "https://prod-kc-os-sink-track.theorchard.io"
                - name: kc-os-sink-project
                  url: "https://prod-kc-os-sink-project.theorchard.io"
                - name: s3-src-spotifyapi
                  url: "https://prod-kafka-connect-s3-source-sa.theorchard.io"
                - name: s3-src-applemusic
                  url: "https://prod-kafka-connect-s3-source-ama.theorchard.io"
                - name: s3-src-participants2
                  url: "https://prod-kafka-connect-s3-source-ep2.theorchard.io"
                - name: s3-src-soundrecordings2
                  url: "https://prod-kafka-connect-s3-source-sr2.theorchard.io"
                - name: snowflake-sink-mg-gsr
                  url: "https://prod-kc-sfsink-mg-gsr.theorchard.io"
                - name: snowflake-sink-mg-nogsr
                  url: "https://prod-kc-sfsink-mg-nogsr.theorchard.io"
                - name: snowflake-sink-nogsr-v4
                  url: "https://prod-kafka-connect-sfsink-nogsr.theorchard.io"
                - name: snowflake-sink-smf-fanresponse
                  url: "https://prod-kc-sfsink-smf-fanresponse.theorchard.io"
                - name: snowflake-sink-nrgraph
                  url: "https://prod-kc-sfsink-nrgraph.theorchard.io"
                - name: salesforce-sink
                  url: "https://prod-kafka-connect-sforce-sink.theorchard.io"
              ksqldb:
                - name: prod-ksqldb
                  url: "https://prod-ksqldb-server.theorchard.io:443"
                  basic-auth-username: "akhq"
                  basic-auth-password: "$${AKHQ_KSQL_PASSWORD}"
                  useTls: true
                  useAlpn: true

            prod-artist-diy:
              properties:
                bootstrap.servers: "b-1.prod-managed-kafka-art.m6a7x5.c6.kafka.us-east-1.amazonaws.com:9094,b-3.prod-managed-kafka-art.m6a7x5.c6.kafka.us-east-1.amazonaws.com:9094,b-2.prod-managed-kafka-art.m6a7x5.c6.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL
              connect:
                - name: sfsink-gda
                  url: "https://prod-kafka-connect-sfsink-gda.theorchard.io"

            prod-db-deploy:
              properties:
                bootstrap.servers: "b-1.prod-managed-kafka-db.62nglp.c21.kafka.us-east-1.amazonaws.com:9094,b-2.prod-managed-kafka-db.62nglp.c21.kafka.us-east-1.amazonaws.com:9094,b-3.prod-managed-kafka-db.62nglp.c21.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL

            prod-pp:
              properties:
                bootstrap.servers: "b-1.prodkafkapp.zrpyzr.c21.kafka.us-east-1.amazonaws.com:9094,b-2.prodkafkapp.zrpyzr.c21.kafka.us-east-1.amazonaws.com:9094,b-3.prodkafkapp.zrpyzr.c21.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL
              connect:
                - name: ddbs-pp-identity
                  url: "https://prod-kc-ddbs-pp-identity.theorchard.io"
                - name: sfsink-pp
                  url: "https://prod-kafka-connect-sfsink-pp.theorchard.io"
                - name: os-sink-smelabel
                  url: "https://prod-kc-os-sink-smelabel.theorchard.io"
                - name: neo4j-src-smelabel
                  url: "https://prod-kc-neo4j-src-smelabel.theorchard.io"

            prod-fansifter:
              properties:
                bootstrap.servers: "b-1.prodmanagedkafkafansi.pmp3ff.c25.kafka.us-east-1.amazonaws.com:9094,b-2.prodmanagedkafkafansi.pmp3ff.c25.kafka.us-east-1.amazonaws.com:9094,b-3.prodmanagedkafkafansi.pmp3ff.c25.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL
              connect:
                - name: sfsink-fnsftr
                  url: "https://prod-kafka-connect-sfsink-fnsftr.theorchard.io"
                - name: sforce-sink-fan-upd
                  url: "https://prod-kc-sforce-sink-fan-upd.theorchard.io"
                - name: sforce-sink-subscrib-upd
                  url: "https://prod-kc-sforce-sink-subscrib-upd.theorchard.io"
            prod-switchboard:
              properties:
                bootstrap.servers: "b-3.sme-switchboard-msk-pr.2fzseu.c6.kafka.us-east-1.amazonaws.com:9094,b-1.sme-switchboard-msk-pr.2fzseu.c6.kafka.us-east-1.amazonaws.com:9094,b-2.sme-switchboard-msk-pr.2fzseu.c6.kafka.us-east-1.amazonaws.com:9094"
                security.protocol: SSL
          security:
            roles:
              topic-read:
                - resources: [ "TOPIC", "TOPIC_DATA" ]
                  actions: [ "READ" ]
                - resources: [ "TOPIC" ]
                  actions: [ "READ_CONFIG" ]
              consumer-group-read:
                - resources: [ "CONSUMER_GROUP" ]
                  actions: [ "READ" ]
              misc-read:
                - resources: [ "SCHEMA", "CONNECT_CLUSTER", "CONNECTOR", "NODE" ]
                  actions: [ "READ" ]
              topic-admin:
                - resources: [ "TOPIC", "TOPIC_DATA" ]
                  actions: [ "READ", "CREATE", "DELETE" ]
                - resources: [ "TOPIC" ]
                  actions: [ "UPDATE", "READ_CONFIG", "ALTER_CONFIG" ]
              consumer-group-admin:
                - resources: [ "CONSUMER_GROUP" ]
                  actions: [ "READ", "UPDATE_OFFSET", "DELETE_OFFSET" ]
              ksqldb-execute:
                - resources: [ "KSQLDB" ]
                  actions: [ "EXECUTE", "READ"]
              ksqldb-read:
                - resources: [ "KSQLDB" ]
                  actions: [ "READ" ]

            default-group: no-roles
            groups:
              power-users:
                - role: topic-admin
                - role: consumer-group-admin
                - role: misc-read
                - role: ksqldb-execute
              users:
                - role: topic-read
                - role: consumer-group-read
                - role: misc-read
                - role: ksqldb-read
            basic-auth:
              - username: admin
                password: "$${AKHQ_ADMIN_PASSWORD_HASH}"
                groups:
                  - admin
            oidc:
              enabled: true
              providers:
                azure:
                  label: "Login with Azure"
                  username-field: preferred_username
                  default-group: users
                  users:
                    - username: jfidlow@sonymusic-pde.com
                      groups:
                        - power-users
                    - username: tmartino@sonymusic-pde.com
                      groups:
                        - power-users
                    - username: rtorres@sonymusic-pde.com
                      groups:
                        - power-users
                    - username: ssavva@sonymusic-pde.com
                      groups:
                        - power-users
                    - username: npatel@sonymusic-pde.com
                      groups:
                        - power-users
                    - username: ntursunkul@sonymusic-pde.com
                      groups:
                        - power-users
            data-masking:
              filters:
                - description: "Mask email, guardianEmail"
                  search-regex: '"(email|guardianEmail)":[ ]?"(.{1})[^@]*@[^.]*\.(.+?)"'
                  replacement: '"$1": "$2[MASKED]@[MASKED].$3"'
                - description: "Mask firstName, lastName, token, fullName"
                  search-regex: '"(firstName|lastName|token|fullName)":[ ]?"([^"]*?)"'
                  replacement: '"$1": "[MASKED]"'
                - description: "Mask email_address"
                  search-regex: '"email_address":[ ]?"(.{1,3})[^@]*@[^.]*\.(.+?)"'
                  replacement: '"email_address": "$1[MASKED]@[MASKED].$2"'
                - description: "Mask mobile_phone"
                  search-regex: '"mobile_phone":[ ]?"(.{5})[^"]*"'
                  replacement: '"mobile_phone": "$1[MASKED]"'
                - description: "Mask first_name, last_name, postal_code, address"
                  search-regex: '"(first_name|last_name|postal_code|address)":[ ]?"([^"]*?)"'
                  replacement: '"$1": "[MASKED]"'
        micronaut:
          security:
            enabled: true
            oauth2:
              enabled: true
              callback-uri: "https://${var.environment}-${var.service_name}.theorchard.io/oauth/callback{/provider}"
              clients:
                azure:
                  client-id: "$${AKHQ_AZURE_CLIENT_ID}"
                  client-secret: "$${AKHQ_AZURE_CLIENT_SECRET}"
                  openid:
                    issuer: "https://login.microsoftonline.com/f0aff3b7-91a5-4aae-af71-c63e1dda2049"
            endpoints:
              logout:
                get-allowed: true
            token:
              jwt:
                enabled: true
                cookie:
                  enabled: true
                generator:
                  access-token:
                    expiration: 43200
                signatures:
                  secret:
                    generator:
                      secret: "$${AKHQ_JWT_SECRET}"
      EOT
    }
  ]

  secrets = [
    {
      AKHQ_JWT_SECRET = "${var.environment}/${var.service_name}/AKHQ_JWT_SECRET"
    },
    {
      AKHQ_ADMIN_PASSWORD_HASH = "${var.environment}/${var.service_name}/AKHQ_ADMIN_PASSWORD_HASH"
    },
    {
      AKHQ_AZURE_CLIENT_ID = "${var.environment}/${var.service_name}/AKHQ_AZURE_CLIENT_ID"
    },
    {
      AKHQ_AZURE_CLIENT_SECRET = "${var.environment}/${var.service_name}/AKHQ_AZURE_CLIENT_SECRET"
    },
    {
      AKHQ_KSQL_PASSWORD = "${var.environment}/${var.service_name}/AKHQ_KSQL_PASSWORD"
    }
  ]
}

module "fargate_service_datadog_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.13.4"

  environment        = var.environment
  application_family = var.application_family
  additional_tags    = var.additional_tags
  environment_type   = "fargate"
  service_name       = var.service_name
  teams              = var.dd_teams

  notification_endpoints            = "@slack-kafka-data-highway-alerts"
  escalation_notification_endpoints = "@slack-kafka-data-highway"
  service_cpu_time_window           = "last_10m" # so it wont alert during deployment.
}