module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/ddex-ingester/rds/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.0.4"

  environment = var.environment
}

data "aws_route53_zone" "orchard" {
  name = "theorchard.io"
}

data "aws_subnet" "swb_vpc_subnets" {
  for_each = toset(var.swb_vpc_subnet_ids)
  id       = each.value
}

module "rds_master_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.4.0"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_master_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "rds_read_only_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.4.0"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_read_only_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "rds_read_write_password" {
  source = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.4.0"

  environment                    = var.environment
  service_name                   = var.service_name
  secret_name                    = "rds_read_write_password"
  application_family             = var.application_family
  secret_recovery_window_in_days = 0
}

module "ddex_ingster_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=6.3.2"

  providers = {
    aws.dns = aws.networking
  }

  environment                               = var.environment
  application_family                        = var.application_family
  service_name                              = var.service_name
  rds_engine                                = "aurora-mysql"
  rds_engine_version                        = "8.0.mysql_aurora.3.05.2"
  rds_cluster_instance_class                = "db.t4g.medium"
  rds_cluster_instance_count                = 1
  rds_port                                  = 3306
  rds_availability_zones                    = ["us-east-1a", "us-east-1c"]
  rds_db_subnet_group_name                  = "prod-orchard-private-subnet-group"
  rds_master_username                       = "dummy"
  rds_master_password                       = "dummy"
  enabled_cloudwatch_logs_exports           = ["audit", "error", "general"]
  rds_performance_insights_enabled          = false
  custom_kms_key_enabled                    = false
  rds_db_cluster_parameter_group_name       = "aurora-mysql80sync"
  rds_cluster_instance_parameter_group_name = "default.aurora-mysql8.0"
  rds_ingress_cidr_blocks = concat(
    [for s in data.aws_subnet.swb_vpc_subnets : s.cidr_block]
  )
  vpc_id          = module.vpc_info.vpc_id
  route53_zone_id = data.aws_route53_zone.orchard.zone_id
}

module "datadog_ddex_ingester_rds" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/rds?ref=6.12.0"

  environment                       = var.environment
  application_family                = var.application_family
  service_name                      = var.service_name
  notification_endpoints            = "@slack-sme-ddex-ingester"
  escalation_notification_endpoints = "@slack-monitoring @slack-sme-ddex-ingester"
}