module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Caller Identity
data "aws_caller_identity" "current" {}

# Terraform backends cannot contain interpolations - of the form ${var.environment}-${var.service_name}-state
terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/ows-video/terraform.tfstate"
    region  = "us-east-1"
    encrypt = true
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_acm_certificate" "theorchard_io" {
  domain   = "*.theorchard.io"
  statuses = ["ISSUED"]
}

data "aws_route53_zone" "route53_zone" {
  name = "theorchard.io"
}

data "aws_route53_zone" "route53_zone_networking" {
  provider = aws.networking

  name = "theorchard.io"
}

data "aws_sfn_state_machine" "video_ingestion_workflow" {
  name = "${var.environment}_${var.video_ingestion_workflow_state_machine_name}"
}

data "aws_sfn_state_machine" "video_approval_workflow" {
  name = "${var.environment}_${var.video_approval_workflow_state_machine_name}"
}

data "aws_sfn_state_machine" "video_ingestion_reencode_workflow" {
  name = "${var.environment}_${var.video_ingestion_reencode_workflow_state_machine_name}"
}

data "aws_iam_policy_document" "ows_video_stepfunctions_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "states:StartExecution",
    ]

    resources = [
      data.aws_sfn_state_machine.video_approval_workflow.arn,
      data.aws_sfn_state_machine.video_ingestion_workflow.arn,
      data.aws_sfn_state_machine.video_ingestion_reencode_workflow.arn,
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "states:StopExecution",
    ]

    resources = [
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:${var.environment}_video_approval_workflow*",
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:${var.environment}_video_ingestion_workflow*",
      "arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:execution:${var.environment}_video_ingestion_reencode_workflow*",
    ]
  }
}

data "aws_iam_policy" "datadog-policy" {
  name = "SecretsManager-${var.environment}-datadog-policy"
}

data "aws_iam_policy" "ows-video-policy" {
  name = "SecretsManager-${var.environment}-ows-video-policy"
}

data "aws_iam_policy" "ows-machine-to-machine-policy" {
  name = "SecretsManager-${var.environment}-ows-machine-to-machine-policy"
}

resource "aws_iam_user" "ows_video_iam_user" {
  name = "${var.environment}-ows-video-user"
  tags = {
    terraformed = true
    role        = "service-user"
  }
}

resource "aws_iam_user_policy_attachment" "iam_user_policy_attachment" {
  user       = aws_iam_user.ows_video_iam_user.name
  count      = length(local.iam_user_managed_policies)
  policy_arn = local.iam_user_managed_policies[count.index]
}

resource "aws_iam_policy" "ows_video_stepfunctions_policy" {
  name   = "${var.environment}-stepfunctions-ows-video-stepfunctions-policy"
  policy = data.aws_iam_policy_document.ows_video_stepfunctions_policy_document.json
}

locals {
  iam_user_managed_policies = [
    aws_iam_policy.s3_list_bucket_policy.arn,
    aws_iam_policy.s3_mezzanine_dir_readonly_policy.arn,
    aws_iam_policy.s3_raw_dir_readonly_policy.arn,
    aws_iam_policy.s3_thumbnails_dir_readonly_policy.arn,
    aws_iam_policy.ows_video_browser_upload_assume_role_policy.arn,
    module.ows_video_service_owsrequest.policy_arn_output,
    aws_iam_policy.ows_video_stepfunctions_policy.arn,
    data.aws_iam_policy.datadog-policy.arn,
    data.aws_iam_policy.ows-video-policy.arn,
    data.aws_iam_policy.ows-machine-to-machine-policy.arn,
    aws_iam_policy.secrets_manager_policy.arn,
  ]
}

data "aws_iam_role" "ows_video_task_role" {
  name = "${var.environment}-${var.service_name}-task-role"
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    effect = "Allow"

    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type = "AWS"
      identifiers = [
        data.aws_iam_role.ows_video_task_role.arn,
        aws_iam_user.ows_video_iam_user.arn,
      ]
    }
  }
}

module "service_info" {
  for_each     = toset(local.downstream_services)
  source       = "git@github.com:theorchard/terraform-service-info.git//?ref=1.1.0"
  service_name = each.value
  environment  = var.environment
}

# Terraform ows-video fargate environment
module "ows_video_service_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.4.3"

  providers = {
    aws.dns = aws.networking
  }

  environment                              = var.environment
  service_name                             = var.service_name
  aws_region                               = var.region
  application_family                       = var.application_family
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 1024
  task_memory                              = 2048
  maximum_capacity                         = 4
  minimum_capacity                         = 2
  health_check_path                        = "/hello/"
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = module.vpc_info.vpc_id
  https_listener_certificate_id            = split("/", data.aws_acm_certificate.theorchard_io.arn)[1]
  target_group_stickiness_enabled          = true
  target_group_cookie_duration             = "300"
  max_session_duration                     = "43200"
  autoscaling_memory_policy_enabled        = true
  scaling_memory_target_value              = 80
  health_check_grace_period_seconds        = 120
  container_start_period_seconds           = 120

  # Overriding here to add in the graphql_switchboard_vpc (10.110.0.0/16) private subnets
  qa_https_listener_allow_cidr_blocks = [
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "10.110.0.0/24",
    "10.110.1.0/24",
  ]

  https_listener_allow_security_group_ids = flatten([
    [for service in module.service_info : service.security_groups],
  ])

  iam_managed_policy_attachments = [
    aws_iam_policy.s3_list_bucket_policy.arn,
    aws_iam_policy.s3_mezzanine_dir_readonly_policy.arn,
    aws_iam_policy.s3_raw_dir_readonly_policy.arn,
    aws_iam_policy.s3_thumbnails_dir_readonly_policy.arn,
    data.aws_iam_policy.s3_raw_and_thumbnails_dir_putonly_policy.arn,
    aws_iam_policy.ows_video_browser_upload_assume_role_policy.arn,
    module.ows_video_service_owsrequest.policy_arn_output,
    aws_iam_policy.ows_video_stepfunctions_policy.arn,
    aws_iam_policy.secrets_manager_policy.arn,
  ]

  fargate_service_subnets = module.vpc_info.default_private_subnet_ids
  load_balancer_subnets   = module.vpc_info.default_private_subnet_ids

  secrets = [
    {
      AWS_ACCESS_KEY_ID = "${var.environment}/ows-video/AWS_ACCESS_KEY_ID"
    },
    {
      AWS_SECRET_ACCESS_KEY = "${var.environment}/ows-video/AWS_SECRET_ACCESS_KEY"
    },
    {
      SPLITIO_API_KEY = "${var.environment}/split/API_KEY"
    },
  ]

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      DATADOG_ENV = "${var.environment}-${var.service_name}"
    },
    {
      DD_LOGS_INJECTION = "true"
    },
    {
      AR_DB_USER = var.AR_DB_USER
    },
    {
      AR_DB_HOST = var.AR_DB_HOST
    },
    {
      AR_DB_NAME = var.AR_DB_NAME
    },
    {
      DD_DB_USER = var.DD_DB_USER
    },
    {
      DD_DB_HOST = var.DD_DB_HOST
    },
    {
      DD_DB_NAME = var.DD_DB_NAME
    },
    {
      UPLOAD_RAW_DIR_ROLE_DURATION_SECONDS = "43200"
    },
    {
      UPLOAD_RAW_ROLE_ARN = aws_iam_role.ows_video_browser_upload_role.arn
    },
    {
      VIDEO_APPROVAL_WORKFLOW_STATE_MACHINE_ARN = data.aws_sfn_state_machine.video_approval_workflow.arn
    },
    {
      VIDEO_DB_USER = var.VIDEO_DB_USER
    },
    {
      VIDEO_DB_HOST = var.VIDEO_DB_HOST
    },
    {
      VIDEO_DB_NAME = var.VIDEO_DB_NAME
    },
    {
      VIDEO_INGESTION_WORKFLOW_STATE_MACHINE_ARN = data.aws_sfn_state_machine.video_ingestion_workflow.arn
    },
    {
      VIDEO_INGESTION_REENCODE_WORKFLOW_STATE_MACHINE_ARN = data.aws_sfn_state_machine.video_ingestion_reencode_workflow.arn
    },
    {
      SENTRY_DSN = module.sentry_ows_video.sentry_key_dsn_public_output
    },
    {
      UWSGI_WORKERS = var.UWSGI_WORKERS
    },
    {
      UWSGI_CHEAPER_RSS_LIMIT_SOFT = tostring(floor(pow(10, 9) * var.UWSGI_CHEAPER_RSS_LIMIT_SOFT_GB))
    },
    {
      CCM_VPB_COMPOSER_REQUIRED = tostring(var.CCM_VPB_COMPOSER_REQUIRED)
    }
  ]
}

data "aws_iam_policy_document" "secrets_manager_policy_document" {
  statement {
    effect = "Allow"

    actions = [
      "secretsmanager:GetSecretValue",
    ]

    resources = [
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/",
      "arn:aws:secretsmanager:*:*:secret:${var.environment}/${var.service_name}/*",
    ]
  }
}

# SecretManager Access Policy
resource "aws_iam_policy" "secrets_manager_policy" {
  name   = "SecretManager-ows-video-secrets-policy"
  policy = data.aws_iam_policy_document.secrets_manager_policy_document.json
}

resource "aws_route53_record" "fargate_record" {
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  name    = "${var.environment}-${var.service_name}-fargate.theorchard.io"
  type    = "CNAME"
  ttl     = "60"
  records = [module.ows_video_service_fargate_environment.fargate_load_balancer_dns_name]
}

resource "aws_route53_record" "fargate_record_networking" {
  provider = aws.networking

  zone_id = data.aws_route53_zone.route53_zone_networking.zone_id
  name    = "${var.environment}-${var.service_name}-fargate.theorchard.io"
  type    = "CNAME"
  ttl     = "60"
  records = [module.ows_video_service_fargate_environment.fargate_load_balancer_dns_name]
}