locals {
  full_service_name = "${var.service_name}-${var.lambda_name}"
  delivery_volume_service_name = "${local.full_service_name}-delivery"
}

module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = local.full_service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/lambda-vector/cleanup-efs/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

# EFS data sources — look up each target EFS volume
data "aws_efs_file_system" "target" {
  creation_token = "${var.environment}-${var.efs_service_name}"
}

data "aws_efs_access_points" "target" {
  file_system_id = data.aws_efs_file_system.target.id
}

data "aws_efs_access_point" "target" {
  access_point_id = one(data.aws_efs_access_points.target.ids)
}

# Find EFS mount target ENIs via the EFS security group
data "aws_network_interfaces" "efs_mount_targets" {
  filter {
    name   = "group-id"
    values = [data.aws_security_group.efs.id]
  }
}

data "aws_network_interface" "efs_mount_target" {
  for_each = toset(data.aws_network_interfaces.efs_mount_targets.ids)
  id       = each.value
}

data "aws_security_group" "efs" {
  name   = "${var.environment}-${var.efs_service_name}-efs-security-group"
  vpc_id = module.vpc_info.vpc_id
}

data "aws_iam_policy" "efs" {
  name = "EFS-${var.environment}-${var.efs_service_name}-policy"
}

# Look up the SG created by the lambda module
data "aws_security_group" "lambda" {
  name       = "${var.environment}-${local.delivery_volume_service_name}-lambda-security-group"
  vpc_id     = module.vpc_info.vpc_id
  depends_on = [module.lambda_cleanup_efs]
}

# Allow the module-managed lambda SG to reach the EFS
resource "aws_security_group_rule" "efs_allow_lambda" {
  type                     = "ingress"
  from_port                = 2049
  to_port                  = 2049
  protocol                 = "tcp"
  security_group_id        = data.aws_security_group.efs.id
  source_security_group_id = data.aws_security_group.lambda.id
}

module "lambda_cleanup_efs" {
  source = "git@github.com:theorchard/terraform-lambda.git//?ref=5.2.2"

  environment         = var.environment
  application_family  = var.application_family
  use_container_image = true
  lambda_name         = local.delivery_volume_service_name
  lambda_description  = "Cleans up old EFS directories based on a retention period"

  lambda_function_timeout                        = var.lambda_timeout
  lambda_function_reserved_concurrent_executions = 1

  vpc_enabled               = true
  vpc_subnet_ids            = [for ni in data.aws_network_interface.efs_mount_target : ni.subnet_id]
  vpc_id                    = module.vpc_info.vpc_id
  vpc_create_security_group = true

  efs_enabled          = true
  efs_access_point_arn = data.aws_efs_access_point.target.arn
  efs_local_mount_path = var.efs_mount_path

  cloudwatch_event_enabled  = true
  cloudwatch_event_schedule = "cron(0 0 * * ? *)"

  datadog_enabled          = true
  datadog_advanced_enabled = true

  splitio_enabled                = false
  ows_machine_to_machine_enabled = false

  iam_managed_policy_attachments = [
    data.aws_iam_policy.efs.arn,
  ]

  lambda_function_environment_variables = {
    EFS_PATH           = var.efs_mount_path
    EFS_RETENTION_DAYS = tostring(var.efs_retention_days)
    SENTRY_DSN         = module.sentry_cleanup_efs.sentry_key_dsn_public_output
  }
}

module "sentry_cleanup_efs" {
  source = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"

  environment        = var.environment
  service_name       = local.full_service_name
  application_family = var.application_family
  teams              = [var.environment]
}

module "datadog_cleanup_efs" {
  source = "git@github.com:theorchard/terraform-datadog.git//modules/lambda?ref=6.17.1"

  environment                       = var.environment
  service_name                      = local.delivery_volume_service_name
  lambda_invocation_monitor_enabled = false
  lambda_error_monitor_enabled      = true
  notification_endpoints            = var.notification_endpoints
}