resource "aws_security_group" "proxy_load_balancer_security_group" {
  name        = "${var.environment}-${var.service_name}-proxy-lb-security-group"
  description = "Load balancer security group for ${var.environment}-${var.service_name}-proxy"
  vpc_id      = module.vpc_info.vpc_id
  ingress {
    description = "Allow inbound traffic from proxy IPs"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.proxy_allowed_ip_ranges
  }

  egress {
    from_port       = var.container_port
    to_port         = var.container_port
    protocol        = "tcp"
    security_groups = [module.ows_users_fargate_environment.fargate_security_group_id]
  }
  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
    eiso-exception     = "aws.08.30"
  }
}

resource "aws_lb" "proxy_application_load_balancer" {
  # checkov:skip=CKV2_AWS_20:We do not use HTTP to HTTPS redirect
  name                       = "${var.environment}-${var.service_name}-proxy-lb"
  internal                   = false
  load_balancer_type         = "application"
  idle_timeout               = "90"
  security_groups            = [aws_security_group.proxy_load_balancer_security_group.id]
  subnets                    = module.vpc_info.default_public_subnet_ids
  enable_deletion_protection = true

  access_logs {
    bucket  = "orch-elb-logs"
    prefix  = "${var.environment}-${var.service_name}-proxy-lb"
    enabled = true
  }

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

resource "aws_lb_listener" "proxy_load_balancer_https_listener" {
  load_balancer_arn = aws_lb.proxy_application_load_balancer.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn   = data.aws_acm_certificate.theorchard_io.arn

  default_action {
    type = "fixed-response"

    fixed_response {
      content_type = "text/plain"
      message_body = "Forbidden"
      status_code  = "403"
    }
  }

  depends_on = [aws_lb_target_group.proxy_fargate_target_group]

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}

resource "aws_lb_target_group" "proxy_fargate_target_group" {
  name                 = "${var.environment}-${var.service_name}-proxy-target-group"
  port                 = var.container_port
  protocol             = "HTTP"
  target_type          = "ip"
  deregistration_delay = "60"
  vpc_id               = module.vpc_info.vpc_id

  # Values copied from terraform-fargate module to match main service settings
  health_check {
    enabled             = true
    healthy_threshold   = "3"
    interval            = "10"
    matcher             = "200"
    path                = "/hello/"
    port                = var.container_port
    protocol            = "HTTP"
    timeout             = "5"
    unhealthy_threshold = "3"
  }

  stickiness {
    type            = "lb_cookie"
    cookie_duration = "86400"
    enabled         = false
  }

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }

  depends_on = [aws_lb.proxy_application_load_balancer]
}

resource "aws_lb_listener_rule" "proxy_rule" {
  listener_arn = aws_lb_listener.proxy_load_balancer_https_listener.arn
  priority     = 100

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.proxy_fargate_target_group.arn
  }

  condition {
    path_pattern {
      values = [
        "/auth0/users*",
        "/hello/",
        "/users/*",
        "/identities/*/application-access/*",
      ]
    }
  }

  tags = {
    environment        = var.environment
    service_name       = var.service_name
    application_family = var.application_family
    terraformed        = true
  }
}


resource "aws_security_group_rule" "allow_inbound_from_proxy_load_balancer" {
  type                     = "ingress"
  from_port                = var.container_port
  to_port                  = var.container_port
  protocol                 = "TCP"
  source_security_group_id = aws_security_group.proxy_load_balancer_security_group.id
  security_group_id        = module.ows_users_fargate_environment.fargate_security_group_id
}

resource "aws_wafv2_web_acl_association" "waf_association" {
  resource_arn = aws_lb.proxy_application_load_balancer.arn
  web_acl_arn  = data.aws_wafv2_web_acl.fargate_service_waf.arn
}

resource "aws_route53_record" "proxy_load_balancer_route53_record" {
  zone_id = data.aws_route53_zone.route53_zone.id
  name    = "${var.environment}-${var.service_name}-proxy"
  type    = "A"

  alias {
    name                   = aws_lb.proxy_application_load_balancer.dns_name
    zone_id                = aws_lb.proxy_application_load_balancer.zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "proxy_load_balancer_route53_record_networking" {
  provider = aws.networking

  zone_id = data.aws_route53_zone.route53_zone_networking.id
  name    = "${var.environment}-${var.service_name}-proxy"
  type    = "A"

  alias {
    name                   = aws_lb.proxy_application_load_balancer.dns_name
    zone_id                = aws_lb.proxy_application_load_balancer.zone_id
    evaluate_target_health = true
  }
}