provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/frontend-seat/internal/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_vpc" "main" {
  tags = {
    Name = "prod"
  }
}

data "aws_subnets" "private" {
  filter {
    name   = "tag:tier"
    values = ["private"]
  }
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.main.id]
  }
}

module "internal_spa" {
  source = "git@github.com:theorchard/terraform-internal-spa.git?ref=2.2.1"

  providers = {
    aws.dns = aws
  }

  environment                   = var.environment
  service_name                  = var.service_name
  application_family            = var.application_family
  vpc_id                        = data.aws_vpc.main.id
  load_balancer_subnet_ids      = slice(data.aws_subnets.private.ids, 0, 2)
  fully_qualified_domain_name   = "${var.service_name}.${var.domain_name}"
  certificate_domain            = "*.${var.domain_name}"
  vpc_endpoint_name             = "prod-s3-interface-vpc-endpoint"
  route53_record_enabled        = false
  spa_rewrite_target            = "index-sme.html"
  enable_pull_request_instances = true
  ingress_prefix_list_names   = [
    "sme-infosec-vm-network",
    "vpn-ny-users",
  ]
}

data "aws_security_group" "alb_ingress" {
  for_each = toset([
    "prod-playwright-tests-lambda-security-group",
    "qa-playwright-tests-lambda-security-group",
    "qa-standalone-frontends-task-security-group",
  ])
  name   = each.key
  vpc_id = data.aws_vpc.main.id
}

resource "aws_vpc_security_group_ingress_rule" "allow_alb_ingress" {
  for_each                     = data.aws_security_group.alb_ingress
  security_group_id            = module.internal_spa.load_balancer_security_group_id
  referenced_security_group_id = each.value.id
  from_port                    = 443
  to_port                      = 443
  ip_protocol                  = "tcp"
  description                  = "Allow ${each.key} to reach internal seat ALB"

  tags = {
    environment        = "qa"
    service_name       = "seat"
    application_family = "user-platform"
  }
}

data "cloudflare_zone" "zone" {
  filter = {
    name = var.domain_name
  }
}

resource "cloudflare_dns_record" "seat_internal" {
  zone_id = data.cloudflare_zone.zone.zone_id
  name    = "${var.service_name}.${var.domain_name}"
  content = module.internal_spa.load_balancer_dns_name
  type    = "CNAME"
  proxied = false
  ttl     = 300
}