module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "qa/tadas-etl/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=3.1.0"

  environment = var.environment
}

data "aws_iam_policy" "existing_policies" {
  for_each = toset(local.existing_policy_names)
  name     = each.value
}

module "efs_volume" {
  source = "git@github.com:theorchard/terraform-efs.git//?ref=4.1.0"

  providers = {
    aws.dns = aws.networking
  }

  environment              = var.environment
  service_name             = var.service_name
  application_family       = var.application_family
  vpc_id                   = module.vpc_info.vpc_id
  subnet_ids               = module.vpc_info.default_private_subnet_ids
  owner_gid                = "1010"
  owner_uid                = "1010"
  access_point_permissions = "755"
}

module "fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.3.1"

  providers = {
    aws.dns = aws.networking
  }

  environment                  = var.environment
  service_name                 = var.service_name
  application_family           = var.application_family
  secrets_manager_service_name = var.secrets_manager_service_name
  aws_region                   = var.aws_region
  commit_sha                   = "latest"
  container_port               = "8080"
  task_type                    = "worker"
  desired_task_count           = 0
  task_cpu                     = 4096
  # memory profiles are in DS-9023 "prepare tadas etl to be deployed as fargate service"
  task_memory                  = 30720
  maximum_capacity             = 1
  minimum_capacity             = 0
  vpc_id                       = module.vpc_info.vpc_id
  cloudwatch_event_enabled     = false
  worker_run_task_role_principals = [
    "arn:aws:iam::437795906767:role/prod-jenkins-aws-task-agent",
  ]

  fargate_service_subnets = module.vpc_info.default_private_subnet_ids
  iam_managed_policy_attachments = concat(
    [
      for policy in data.aws_iam_policy.existing_policies : policy.arn
    ],
    [
      module.efs_volume.efs_iam_policy_arn_output
    ]
  )

  docker_volumes = [
    {
      name            = "${var.environment}-${var.service_name}"
      file_system_id  = module.efs_volume.efs_file_system_id_output
      access_point_id = module.efs_volume.efs_access_point_id_output
    }
  ]

  docker_volume_mount_points = [
    {
      source_volume  = "${var.environment}-${var.service_name}"
      container_path = var.efs_volume_container_path
    }
  ]

  environment_variables = [
    {
      ENVIRONMENT = var.environment
    },
    {
      SNOWFLAKE_USER = var.snowflake_user
    },
    {
      SNOWFLAKE_SCHEMA = var.snowflake_schema
    },
    {
      SNOWFLAKE_WAREHOUSE = var.snowflake_warehouse
    },
    {
      SNOWFLAKE_ACCOUNT = var.snowflake_account
    },
    {
      SNOWFLAKE_DATABASE = var.snowflake_database
    },
    {
      SNOWFLAKE_ROLE = var.snowflake_role
    },
    {
      TADAS_TRIGGER_JENKINS = "Y"
    },
    {
      JENKINS_URL = var.jenkins_url
    },
    {
      JENKINS_USERNAME = var.jenkins_username
    },
    {
      TADAS_UPDATE_DYNAMODB_STATUS = "Y"
    },
    {
      FEED_INGESTION_TABLE = local.feed_ingestion_table
    },
    {
      REQUIRED_DSPS = var.required_dsps
    },
    {
      MODEL_VERSION = var.model_version
    },
  ]
  secrets = [
    {
      SENTRY_DSN = "${var.environment}/${var.secrets_manager_service_name}/SENTRY_DSN"
    },
    {
      SNOWFLAKE_KEY = "${var.environment}/${var.secrets_manager_service_name}/SNOWFLAKE_KEY"
    },
    {
      JENKINS_API_TOKEN = "${var.environment}/${var.secrets_manager_service_name}/JENKINS_API_TOKEN"
    },
  ]
}

data "aws_iam_policy_document" "list_task_definition_policy" {
  statement {
    actions = [
      "ecs:ListTaskDefinitions"
    ]
    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "ecs:DescribeTaskDefinition"
    ]
    resources = [
      "${module.fargate_environment.fargate_task_definition_arn_without_revision}:*"
    ]
  }
}

resource "aws_iam_role_policy" "list_task_definition_role_policy" {
  name = "ECS_list_task_definition_role_policy"

  role = module.fargate_environment.fargate_run_task_role_name
  policy = data.aws_iam_policy_document.list_task_definition_policy.json
}


module "secrets" {
  source             = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each           = toset(var.secrets_manager_secret_names)
  environment        = var.environment
  service_name       = var.secrets_manager_service_name
  secret_name        = each.value
  application_family = var.application_family
}

module "sentry_project" {
  source                       = "git@github.com:theorchard/terraform-sentry.git//?ref=4.1.2"
  service_name                 = var.service_name
  application_family           = var.application_family
  secrets_manager_service_name = var.secrets_manager_service_name
  environment                  = var.environment
  teams                        = [var.environment]
  platform                     = "python"
}