module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/daemon-youtube-ownership/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.2"

  environment = var.environment
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io."
}

# we can potentially use the policy arn from the module output,
# however not all actions enabled in the policy is present in the policy created in the module
data "aws_iam_policy" "daemon_youtube_ownership_deadletter_access_policy" {
  name = "SQS-${var.environment}-yt-ownership-Read-Delete"
}

module "daemon_youtube_ownership_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.1"
  environment_name = var.environment
  service_name     = var.service_name
}

module "daemon_youtube_ownership_sqs_queue" {
  source             = "git@github.com:theorchard/terraform-sqs.git//?ref=2.3.3"
  environment        = var.environment
  custom_queue_name  = "${var.environment}-yt-ownership-1"
  application_family = var.application_family

  # those are the current values
  sqs_deadletter_enabled        = false
  sqs_delay_seconds             = 0
  sqs_max_message_size          = 262144
  sqs_message_retention_seconds = 1209600
  sqs_receive_wait_time_seconds = 0
}

module "multiple_secrets_with_same_settings" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.3.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = each.value
  application_family             = var.application_family
  secret_recovery_window_in_days = 7
}

module "daemon_youtube_ownership_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.2.1"

  providers = {
    aws.dns = aws.networking
  }

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family

  rds_master_username = "daemon_youtube_ownership_admin"
  rds_master_password = "s0mePass!changme"

  rds_cluster_instance_class                = "db.t4g.medium"
  rds_cluster_instance_count                = "1"
  rds_db_cluster_parameter_group_name       = "aurora-mysql80sync"
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_engine                                = "aurora-mysql"
  rds_engine_version                        = "8.0.mysql_aurora.3.05.2"
  rds_db_subnet_group_name                  = "prod-orchard-private-subnet-group"
  rds_availability_zones                    = ["us-east-1a", "us-east-1c"]
  rds_performance_insights_enabled          = false
  enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]

  vpc_id          = module.vpc_info.vpc_id
  route53_zone_id = data.aws_route53_zone.route53_zone.zone_id
}

module "daemon_youtube_ownership_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.5.1"

  providers = {
    aws.dns = aws.networking
  }

  application_family                    = var.application_family
  environment                           = var.environment
  service_name                          = var.service_name
  aws_region                            = var.aws_region
  commit_sha                            = "latest"
  container_port                        = "8080"
  task_type                             = "worker"
  desired_task_count                    = 1
  task_cpu                              = 512
  task_memory                           = 1024
  maximum_capacity                      = 1
  minimum_capacity                      = 1
  vpc_id                                = module.vpc_info.vpc_id
  fargate_spot_capacity_provider_weight = 100
  task_placement_failure_alert_enabled  = true
  autoscaling_cpu_policy_enabled        = false

  iam_managed_policy_attachments = [
    module.daemon_youtube_ownership_owsrequest.policy_arn_output,
    data.aws_iam_policy.daemon_youtube_ownership_deadletter_access_policy.arn
  ]

  fargate_service_subnets = module.vpc_info.default_private_subnet_ids

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      DATADOG_ENV = "${var.environment}-${var.service_name}"
    },
    {
      DD_LOGS_INJECTION = "true"
    },
    {
      AWS_REGION = var.aws_region
    },
    {
      DEBUG = "1"
    },
    {
      LOGGER_DSN = "https://${var.environment}-fluentd-applications.theorchard.io:8888/application"
    }
  ]
  secrets = [
    {
      DB_CONNECTION_STRING = "${var.environment}/${var.service_name}/DB_CONNECTION_STRING"
    },
    {
      SENTRY_DSN = "${var.environment}/${var.service_name}/SENTRY_DSN"
    },
    {
      GOOGLE_API_KEY = "${var.environment}/${var.service_name}/GOOGLE_API_KEY"
    },
  ]
}

module "fargate_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.10.7"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  application_family                = var.application_family
  escalation_notification_endpoints = var.notification_endpoints
  notification_endpoints            = var.notification_endpoints
  service_5xx_monitor_enabled       = true
}

module "daemon_youtube_ownership_rds_dashboard" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/rds?ref=6.10.7"

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name

  notification_endpoints            = var.notification_endpoints
  escalation_notification_endpoints = var.notification_endpoints
}

# Datadog configs for creating custom monitors
data "aws_secretsmanager_secret" "datadog_api" {
  name = "${var.environment}/datadog/DD_API_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_api" {
  secret_id = data.aws_secretsmanager_secret.datadog_api.id
}

data "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.environment}/datadog/DD_APP_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_app_key" {
  secret_id = data.aws_secretsmanager_secret.datadog_app_key.id
}
provider "datadog" {
  api_key = data.aws_secretsmanager_secret_version.datadog_api.secret_string
  app_key = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
}
resource "datadog_monitor" "youtube_daemon_queue" {
  name    = "${var.environment}-${var.youtube_daemon_queue_monitor}"
  type    = "metric alert"
  message = "Running https://pipeline.theorchard.io/job/fargate-redeploy with PROD + daemon-youtube-ownership usually fixes this if its stuck. Notify: ${var.notification_endpoints}"

  query = "avg(last_1h):max:aws.sqs.approximate_number_of_messages_visible{queuename:${var.environment}-yt-ownership-1} > 30000"

  monitor_thresholds {
    critical = 30000
  }

  renotify_interval   = 60    // minutes
  require_full_window = false // DD recommends setting to false for sparse metrics

  tags = [
    "environment:${var.environment}",
    "service:${var.service_name}",
  ]
}