module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = "devops"
  service_name       = var.aws_stack_name
  team_name          = "devops"
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "shared/jenkins/pipeline/agents/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.0.0"

  environment = var.environment
}

data "aws_iam_policy" "shared_ami_kms_policy" {
  name = "KMS-shared-base-amis-RO"
}

# Get the ec2 prefix lists to allow access
data "aws_ec2_managed_prefix_list" "prefix_lists" {
  for_each = var.prefix_lists_to_allow_ssh
  name     = each.value
}

# Security group for agent ingress from prod account prefix
resource "aws_security_group" "ssh_security_group" {
  name   = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
  vpc_id = module.vpc_info.vpc_id

  tags = {
    Name        = "${var.environment}-${var.aws_stack_name}-agent-ssh-ingress"
    terraformed = true
  }
}

resource "aws_security_group_rule" "ssh_rule" {
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  type              = "ingress"
  prefix_list_ids   = [for list in data.aws_ec2_managed_prefix_list.prefix_lists : list.id]
  security_group_id = aws_security_group.ssh_security_group.id
}

resource "aws_key_pair" "jenkins" {
  key_name   = "jenkins"
  public_key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGorjqOXsMj97tY0H5zRX3vxNAiImtidyDoSlD88myOq jenkins-shared-aws-account-key"
}

module "jenkins_agent" {
  source = "git@github.com:theorchard/terraform-jenkins.git//modules/jenkins_agent?ref=5.0.0"

  environment                     = var.environment
  aws_stack_name                  = "${var.environment}-${var.aws_stack_name}-agent"
  user_data                       = module.jenkins_agent_bootstrap.user_data_output
  aws_instance_type               = "m7i.large"
  aws_key_name                    = aws_key_pair.jenkins.key_name
  aws_volume_size                 = "100"
  vpc_id                          = module.vpc_info.vpc_id
  aws_asg_max_size                = "2"
  aws_asg_min_size                = "2"
  aws_asg_desired_capacity        = "2"
  asg_suspended_processes         = var.asg_suspended_processes
  additional_security_group_ids   = [aws_security_group.ssh_security_group.id]
  vpc_private_subnet_ids          = module.vpc_info.default_private_subnet_ids
}

resource "aws_iam_role_policy_attachment" "shared_ami_kms_policy_attachment" {
  role       = module.jenkins_agent.aws_iam_role_id_output
  policy_arn = data.aws_iam_policy.shared_ami_kms_policy.arn
}

module "jenkins_agent_bootstrap" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=3.3.0"

  chef_role         = "prod_jenkins_aws_agent"
  aws_instance_name = "${var.environment}-${var.aws_stack_name}-agent"
  aws_iam_role_id   = module.jenkins_agent.aws_iam_role_id_output
}

# AssumeRole access.
resource "aws_iam_policy" "jenkins_agent_assume_role_policy" {
  name   = "STS-${var.environment}-${var.aws_stack_name}-AssumeRole-policy"
  policy = data.aws_iam_policy_document.jenkins_agent_assume_role_policy.json

  tags = {
    environment        = var.environment
    service_name       = var.aws_stack_name
    application_family = var.application_family
  }
}

data "aws_iam_policy_document" "jenkins_agent_assume_role_policy" {
  statement {
    effect    = "Allow"
    actions   = ["sts:AssumeRole"]
    resources = var.roles_to_assume
  }
}

resource "aws_iam_role_policy_attachment" "jenkins_agent_assume_role_policy_attachment" {
  role       = module.jenkins_agent.aws_iam_role_id_output
  policy_arn = aws_iam_policy.jenkins_agent_assume_role_policy.arn
}