module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/lambda-vector/renew-manager/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

module "sentry_lambda_renew_manager" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
}

data "aws_iam_policy_document" "fargate_renew_manager_policy" {
  statement {
    actions = [
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueueTags",
      "sqs:ListQueues",
      "sqs:TagQueue",
      "sqs:UntagQueue",
      "sqs:SendMessageBatch",
      "sqs:SendMessage",
      "sqs:CreateQueue"
    ]

    resources = [
      "arn:aws:sqs:*",
    ]
  }
}

# Create renew manager IAM policy
resource "aws_iam_policy" "fargate_renew_manager_policy" {
  name   = "${var.environment}-renew-manager-fargate-policy"
  policy = data.aws_iam_policy_document.fargate_renew_manager_policy.json
}

module "renew_manager_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.6.0"

  providers = {
    aws.dns = aws.networking
  }

  environment          = var.environment
  application_family   = var.application_family
  service_name         = var.service_name
  aws_region           = var.region
  commit_sha           = "latest"
  container_port       = "8080"
  task_type            = "worker"
  health_check_command = "pgrep python"
  desired_task_count   = 1
  task_cpu             = 1024
  task_memory          = 2048
  maximum_capacity     = 1
  minimum_capacity     = 1
  # Ensures only one task is running during deployments
  deployment_maximum_percent         = 100
  deployment_minimum_healthy_percent = 0
  availability_zone_rebalancing      = "DISABLED"
  vpc_id                             = module.vpc_info.vpc_id
  cloudwatch_event_enabled           = false
  ows_machine_to_machine_enabled     = false
  splitio_enabled                    = false
  task_protection_policy_enabled     = true
  fargate_service_subnets            = module.vpc_info.default_private_subnet_ids

  iam_managed_policy_attachments = [
    aws_iam_policy.fargate_renew_manager_policy.arn
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      LOGGER_DSN = var.LOGGER_DSN
    },
    {
      SENTRY_DSN = module.sentry_lambda_renew_manager.sentry_key_dsn_public_output
    },
    {
      DD_MYSQL_USER = "lambda-renew-mgr"
    },
    {
      DD_MYSQL_HOST = "dd-db.theorchard.com"
    },
    {
      DD_MYSQL_PORT = 3306
    },
    {
      DD_MYSQL_DATABASE = "direct_delivery"
    },
    {
      GRAS_DELIVERY_STORE_IDS = "669,738,739"
    }
  ]
}

module "secrets_renew_manager" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(["DD_MYSQL_PASSWORD"])

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}