module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/vector/direct_delivery_update/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}

data "aws_caller_identity" "current" {}

# Create KMS key and policies for certain encrypted configuration
resource "aws_kms_key" "dd_update_kms_key" {
  description             = "${var.environment}-${var.service_name}"
  enable_key_rotation     = true
  deletion_window_in_days = 30

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

resource "aws_kms_alias" "dd_update_kms_alias" {
  name          = "alias/${var.environment}-${var.service_name}"
  target_key_id = aws_kms_key.dd_update_kms_key.key_id
}

data "aws_iam_policy_document" "kms_decryption_policy" {
  statement {
    actions = [
      "kms:Decrypt",
      "kms:DescribeKey",
    ]

    resources = [
      aws_kms_key.dd_update_kms_key.arn,
    ]
  }
}

# Create KMS policy
resource "aws_iam_policy" "dd_update_kms_policy" {
  name   = "KMS-${var.environment}-${var.service_name}-policy"
  policy = data.aws_iam_policy_document.kms_decryption_policy.json

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

# sentry module
module "sentry_direct_delivery_update" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
  teams              = [var.environment]
  platform           = "php"
}

module "dd_update_owsreqeust" {
  source = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.1.0"

  policy_description = "Dynamo-${var.environment}-${var.service_name}-owsrequest"
  environment_name   = var.environment
  service_name       = var.service_name
}

module "dd_update_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.4.3"

  providers = {
    aws.dns = aws
  }

  environment                        = var.environment
  service_name                       = var.service_name
  aws_region                         = var.aws_region
  application_family                 = var.application_family
  task_type                          = "worker"
  health_check_command               = "pgrep php"
  deployment_minimum_healthy_percent = "100"
  autoscaling_cpu_policy_enabled     = false
  autoscaling_memory_policy_enabled  = false
  desired_task_count                 = 0
  minimum_capacity                   = 0
  maximum_capacity                   = 1
  task_cpu                           = 2048
  task_memory                        = 4096
  container_port                     = 8080
  health_check_grace_period_seconds  = 300
  container_start_period_seconds     = 300
  target_deregistration_delay        = 300
  cloudwatch_event_enabled           = true
  cloudwatch_event_schedule          = "rate(10 minutes)"
  vpc_id                             = module.vpc_info.vpc_id
  fargate_service_subnets            = concat(["subnet-043d235081c966332", "subnet-067a6b45b079d7296"], module.vpc_info.default_private_subnet_ids)
  ows_machine_to_machine_enabled     = true
  splitio_enabled                    = false

  iam_managed_policy_attachments = [
    aws_iam_policy.dd_update_kms_policy.arn,
    module.dd_update_owsreqeust.policy_arn_output,
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      AR_DB_HOST = var.ar_db_host
    },
    {
      AR_DB_USER = var.ar_db_user
    },
    {
      AWS_REGION = var.aws_region
    },
    {
      DD_DB_HOST = var.dd_db_host
    },
    {
      DD_DB_USER = var.dd_db_user
    },
    {
      PHP_MEMORY_LIMIT = "1024M"
    },
    {
      PHP_DATE_TIMEZONE = "America/New_York"
    },
    {
      SENTRY_DSN = module.sentry_direct_delivery_update.sentry_key_dsn_public_output
    },
  ]

  secrets = [
    {
      AR_DB_PASSWORD = "${var.environment}/${var.service_name}/AR_DB_PASSWORD"
    },
    {
      DD_DB_PASSWORD = "${var.environment}/${var.service_name}/DD_DB_PASSWORD"
    },
  ]
}

module "dd_update_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
  application_family = var.application_family
}

module "dd_update_fargate_service_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"

  environment        = var.environment
  environment_type   = "fargate"
  service_name       = var.service_name
  application_family = var.application_family

  healthy_tasks_monitor_enabled = false

  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.notification_endpoints
}

module "m2m_secrets" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//modules/auth0m2m?ref=1.6.1"

  environment                         = var.environment
  service_name                        = var.service_name
  application_family                  = var.application_family
}