data "aws_route53_zone" "dns_zone" {
  name = "theorchard.io."
}

module "opensearch" {
  source = "git@github.com:theorchard/terraform-elasticsearch.git//?ref=4.1.3"

  providers = {
    aws.dns = aws.networking
  }

  application_family         = var.application_family
  use_opensearch_engine      = true
  env                        = var.environment
  aws_es_domain_name         = var.domain_name
  aws_es_version             = "OpenSearch_2.19"
  aws_es_instance_type       = "r6g.2xlarge.search"
  aws_es_instance_count      = 4
  dedicated_master_enabled   = false
  aws_es_disk_size           = 250
  aws_es_disk_type           = "gp3"
  zone_awareness_enabled     = false # explicitly set to false.
  vpc_id                     = module.vpc_info.vpc_id
  subnet_ids                 = slice(module.vpc_info.default_private_subnet_ids, 0, 1)
  aws_route53_params_zone_id = data.aws_route53_zone.dns_zone.zone_id

  # Only for Prod.
  https_allowed_custom_prefix_list_names = [
    "vpn-ny-users",
    "shared-orcd-atlantis-private-subnet-prefix-list",
  ]

  advanced_security_options_enabled = true
  # internal_user_database is false for ES but we need username/password credentials for OS-SINK connector.
  # once the backfill is done: turn internal_user_database off and uncomment to set iam_master_user to the role.
  # advanced_security_options_iam_master_user_arn = aws_iam_role.os_manager_role.arn
  advanced_security_options_iam_master_user_arn = ""
  advanced_security_options_internal_user_database_enabled = true
}