module "graphql_switchboard_sentry" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  environment        = var.environment
  service_name       = var.graphql_service_name
  platform           = "python"
  application_family = var.application_family
  teams              = [var.environment]
}

# Allow service to assume role for cross-account SecretsManager access
data "aws_iam_policy_document" "graphql_assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    resources = [
      "arn:aws:iam::019963779799:role/ProdOrchardAccess",
    ]
  }
}

resource "aws_iam_policy" "graphql_assume_role_policy" {
  name   = "${var.environment}-${var.graphql_service_name}-sts-assume-role-policy"
  policy = data.aws_iam_policy_document.graphql_assume_role_policy.json
}

module "graphql_switchboard_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.5.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                              = var.environment
  service_name                             = var.graphql_service_name
  aws_region                               = var.aws_region
  application_family                       = var.application_family
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 1024
  task_memory                              = 2048
  maximum_capacity                         = 4
  minimum_capacity                         = 2
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = data.aws_vpc.vpc.id
  https_listener_certificate_id            = split("/", data.aws_acm_certificate.theorchard_io.arn)[1]
  splitio_enabled                          = true

  iam_managed_policy_attachments = [
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    aws_iam_policy.graphql_assume_role_policy.arn,
  ]

  fargate_service_subnets = data.aws_subnets.private.ids
  load_balancer_subnets   = data.aws_subnets.private.ids

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      LOGGER_DSN = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application"
    },
    {
      SENTRY_DSN = module.graphql_switchboard_sentry.sentry_key_dsn_public_output
    },
    {
      SWITCHBOARD_ROLE_ARN = "arn:aws:iam::019963779799:role/ProdOrchardAccess"
    },
    {
      SWITCHBOARD_SECRET_ARN = "arn:aws:secretsmanager:us-east-1:019963779799:secret:prod-system-jwt-secret-dIJkPs"
    },
    {
      GRAPHQL_PRODUCT_HOST = "https://${var.environment}-graphql-product.theorchard.io"
    },
    {
      AUTH0_CREDENTIALS_ARN = module.graphql_switchboard_secrets["AUTH0_CREDENTIALS"].secret_arn
    },
    {
      AUTH0_AUDIENCE = "https://workstation.theorchard.com/api"
    },
    {
      GRASS_URL = "https://ows-grass.theorchard.io"
    },
    {
      INTROSPECTION = "1"
    },
  ]
  
  secrets = [
    {
      SPLIT_API_KEY = "${var.environment}/split/API_KEY"
    },
  ]
}

module "graphql_switchboard_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.graphql_service_name
  application_family                = var.application_family
  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.escalation_notification_endpoints
  service_4xx_monitor_enabled       = false
}