# Dedicated ElastiCache Redis for the ows-royalties rate limiter.
# Sized for the rate-limit store only (sliding-window-counter keys are tiny + TTL'd).
# Resize (t4g.small+/reserved) when the ElastiCache dashboard shows CPU>70% or CPU-credit
# depletion, memory>70% / Evictions|SwapUsage>0, CurrConnections near the node limit, or the
# breaker gauge hardening.breaker.state{resource:ratelimit-redis} flapping to open.
module "ows_royalties_ratelimit_cache" {
  source = "git@github.com:theorchard/terraform-elasticache.git//?ref=4.0.2"

  providers = { aws.dns = aws.networking }

  environment                    = var.environment
  service_name                   = "${var.service_name}-ratelimit"
  application_family             = var.application_family
  cache_engine                   = "redis"
  redis_engine_version           = "7.1"
  cache_subnet_group_name        = "${var.environment}-elasticache-subnet-group"
  cache_node_type                = "cache.t4g.micro"
  cache_node_count               = 1 # single node; the in-memory circuit-breaker fallback is the resilience story, not Redis HA
  redis_snapshot_retention_limit = 0 # rate-limit keys are ephemeral and short-lived; no backups needed
  cache_parameter_group_name     = "default.redis7"
  vpc_id                         = module.vpc_info.vpc_id

  cache_at_rest_encryption_enabled = true
  cache_transit_encryption_enabled = true # app connects via rediss:// (TLS)
}

module "ows_royalties_ratelimit_cache_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/elasticache?ref=6.19.0"

  environment        = var.environment
  service_name       = "${var.service_name}-ratelimit"
  application_family = var.application_family
  teams              = ["abacus-${var.environment}"]

  # NOTE: ows-royalties does NOT define ows-coda's `local.datadog_*` locals -- referencing them
  # fails `terraform plan` with "Reference to undeclared local value". prod/ows-royalties uses the
  # `var.notification_endpoints` variable (confirmed: prod/ows-royalties/main.tf uses it for its
  # service dashboard). qa/uat use literal strings instead (see B2/B3).
  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.notification_endpoints
}