module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

# Provider determines the method (AWS) and some basic provider properties
provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/ddex-ingester/rds/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_subnet" "swb_vpc_subnets" {
  for_each = toset(var.swb_vpc_subnet_ids)
  id       = each.value
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io"
}

module "rds_master_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_master_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "rds_read_only_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_read_only_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "rds_read_write_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_read_write_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "ddex_ingster_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.6.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                     = var.environment
  application_family              = var.application_family
  service_name                    = var.service_name
  rds_engine                      = "aurora-mysql"
  rds_engine_version              = "8.0.mysql_aurora.3.08.2"
  rds_cluster_instance_class      = "db.r6g.large"
  rds_cluster_instance_count      = 1
  rds_port                        = 3306
  rds_availability_zones          = ["us-east-1a", "us-east-1c"]
  rds_db_subnet_group_name        = "prod-orchard-private-subnet-group"
  rds_master_username             = "dummy"
  rds_master_password             = "dummy"
  enabled_cloudwatch_logs_exports = ["audit", "error", "general"]

  rds_performance_insights_enabled          = true
  custom_kms_key_enabled                    = false
  rds_db_cluster_parameter_group_name       = "aurora-mysql80sync"
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_ingress_cidr_blocks = concat(
    var.rds_ingress_cidr_blocks,
    [for s in data.aws_subnet.swb_vpc_subnets : s.cidr_block]
  )

  vpc_id          = module.vpc_info.vpc_id
  route53_zone_id = data.aws_route53_zone.route53_zone.id
}

module "datadog_ddex_ingester_rds" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/rds?ref=6.13.6"

  environment                       = var.environment
  application_family                = var.application_family
  service_name                      = var.service_name
  notification_endpoints            = "@slack-sme-ddex-ingester"
  escalation_notification_endpoints = "@slack-monitoring @slack-sme-ddex-ingester"
}