module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/distribution/distro-scripts/dolby-atmos-packager-alpha/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.0.2"

  environment = var.environment
}

module "input_s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.11.0"

  bucket_name        = "${var.service_name}-input"
  env                = var.environment
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }
}

module "output_s3_bucket" {
  source = "git@github.com:theorchard/terraform-s3.git//modules/s3_bucket?ref=3.12.0"

  bucket_name        = "${var.service_name}-output"
  env                = var.environment
  application_family = var.application_family

  apply_server_side_encryption_by_default = {
    sse_algorithm = "AES256"
  }

  lifecycle_rules_options_noncurrent_version_expiration = [
    {
      prefix = ""
      enabled = true
      days = 1
    }
  ]

  lifecycle_rules_options_current_version_expiration = [
    {
      prefix  = ""
      enabled = true
      days    = 30
    },
  ]

  lifecycle_rules_expired_object_delete_markers_expiration = [
    {
      prefix  = ""
      enabled = true
    },
  ]
}

data "aws_iam_policy_document" "s3_access_policy" {
  statement {
    effect = "Allow"

    actions = [
      "s3:ListBucket"
    ]

    resources = [
      module.input_s3_bucket.s3_bucket_arn_output,
      module.output_s3_bucket.s3_bucket_arn_output
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:PutObject",
      "s3:HeadObject",
      "s3:GetObject"
    ]

    resources = [
      "${module.input_s3_bucket.s3_bucket_arn_output}/*",
      "${module.output_s3_bucket.s3_bucket_arn_output}/*"
    ]
  }
}

resource "aws_iam_policy" "s3_access_policy" {
  name        = "S3-${var.environment}-${var.service_name}-RW"
  description = "Read and write to ${var.service_name} buckets"
  policy      = data.aws_iam_policy_document.s3_access_policy.json
}

module "dolby_atmos_packager_alpha_sentry_project" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"

  service_name       = var.service_name
  environment        = var.environment
  teams              = [var.environment]
  application_family = var.application_family
  platform           = "python"
}

module "dolby_atmos_packager_alpha_owsrequest" {
  source = "git@github.com:theorchard/terraform-owsrequest.git?ref=1.0.1"

  environment_name = var.environment
  service_name     = var.service_name
}

data "aws_iam_policy" "s3_mezz_ro" {
  name = "S3-${var.environment}-orcd-mezzanine-assets-RO"
}

module "dolby_atmos_packager_alpha_fargate" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=5.5.1"

  providers = {
    aws.dns = aws.networking
  }

  environment        = var.environment
  service_name       = var.service_name
  application_family = var.application_family
  aws_region         = var.region
  commit_sha         = "latest"

  autoscaling_cpu_policy_enabled = false

  task_type            = "worker"
  health_check_command = "python --version"
  desired_task_count   = 0
  task_cpu             = 1024
  task_memory          = 2048
  maximum_capacity     = 5
  minimum_capacity     = 0
  datadog_enabled      = true

  vpc_id                  = module.vpc_info.vpc_id
  fargate_service_subnets = module.vpc_info.default_private_subnet_ids

  splitio_enabled                 = false
  ows_machine_to_machine_enabled  = true
  stopped_task_monitoring_enabled = false

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_access_policy.arn,
    module.dolby_atmos_packager_alpha_owsrequest.policy_arn_output,
    data.aws_iam_policy.s3_mezz_ro.arn
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      INPUT_BUCKET = module.input_s3_bucket.s3_bucket_name_output
    },
    {
      OUTPUT_BUCKET = module.output_s3_bucket.s3_bucket_name_output
    },
    {
      USER_IDENTITY_ID = var.user_identity_id
    },
    {
      USER_IDENTITY_UUID = var.user_identity_uuid
    },
    {
      USER_PROFILE_ID = var.user_profile_id
    },
    {
      USER_PROFILE_UUID = var.user_profile_uuid
    },
    {
      USER_PROFILE_TYPE = var.user_profile_type
    },
    {
      USER_ROLES = var.user_roles
    }
  ]

  secrets = [
    {
      SENTRY_DSN = "${var.environment}/${var.service_name}/SENTRY_DSN"
    }
  ]
}

data "aws_iam_policy_document" "assume_role_policy_document" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/prod-jenkins-aws-task-agent",
      ]
    }
  }
}

data "aws_iam_policy_document" "run_task_policy_document" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeSubnets",
      "ec2:DescribeVpcs",
      "ecs:DescribeTasks"
    ]
    resources = ["*"]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecs:RunTask",
      "ecs:StartTask"
    ]
    resources = [
      "${module.dolby_atmos_packager_alpha_fargate.fargate_task_definition_arn_without_revision}:*",
      module.dolby_atmos_packager_alpha_fargate.fargate_cluster_arn
    ]
  }

  statement {
    effect = "Allow"
    actions = [
      "ecs:TagResource",
    ]
    resources = ["*"]
    condition {
      test     = "StringEquals"
      variable = "ecs:CreateAction"
      values = [
        "RunTask",
        "StartTask",
      ]
    }
  }

  statement {
    effect  = "Allow"
    actions = ["iam:PassRole"]
    condition {
      test     = "StringLike"
      variable = "iam:PassedToService"
      values   = ["ecs-tasks.amazonaws.com"]
    }
    resources = [
      module.dolby_atmos_packager_alpha_fargate.fargate_task_iam_role_arn,
      module.dolby_atmos_packager_alpha_fargate.fargate_task_iam_execution_role_arn
    ]
  }
}

resource "aws_iam_role" "jenkins_run_role" {
  name                  = "${var.environment}-${var.service_name}-jenkins-run-role"
  force_detach_policies = true
  assume_role_policy    = data.aws_iam_policy_document.assume_role_policy_document.json

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = "true"
  }
}

resource "aws_iam_policy" "jenkins_run_policy" {
  name   = "${var.environment}-${var.service_name}-run-policy"
  policy = data.aws_iam_policy_document.run_task_policy_document.json

  tags = {
    application_family = var.application_family
    environment        = var.environment
    service_name       = var.service_name
    terraformed        = "true"
  }
}

resource "aws_iam_role_policy_attachment" "jenkins_run_policy_attachment" {
  role       = aws_iam_role.jenkins_run_role.id
  policy_arn = aws_iam_policy.jenkins_run_policy.arn
}