module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "prod/jump-box/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

# Get the latest PDE Debian 12 AMI id
data "aws_ami" "debian" {
  most_recent = true

  owners = ["086679231553"]

  filter {
    name   = "name"
    values = ["debian-12-amd64-*"]
  }

  filter {
    name   = "architecture"
    values = ["x86_64"]
  }
}

data "aws_key_pair" "orchard_admin" {
  key_name = "orchard_admin"
}

data "aws_subnet" "main" {
  filter {
    name   = "vpc-id"
    values = [module.vpc_info.vpc_id]
  }

  tags = {
    Name = "shared_jump_box_subnet_us_east_1a"
  }
}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.0.0"

  environment = var.environment
}

data "aws_ec2_managed_prefix_list" "vpn_ny" {
  name = "vpn-ny"
}

data "aws_ec2_managed_prefix_list" "vpn_ny_users" {
  name = "vpn-ny-users"
}

data "aws_route53_zone" "route53_zone" {
  name = "${var.environment}.theorchard.io."
}

data "aws_kms_alias" "ebs_key" {
  name = "alias/aws/ebs"
}

resource "aws_security_group" "instance_security_group" {
  name        = "${var.environment}-${var.service_name}-instance-security-group"
  description = "Instance security group for ${var.environment}-${var.service_name}"
  vpc_id      = module.vpc_info.vpc_id

  tags = {
    eiso-exception = "aws.08.30"
  }
}

resource "aws_security_group_rule" "allow_ssh" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "TCP"
  prefix_list_ids   = [data.aws_ec2_managed_prefix_list.vpn_ny.id]
  security_group_id = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_ssh_ny_vpn_users" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "TCP"
  prefix_list_ids   = [data.aws_ec2_managed_prefix_list.vpn_ny_users.id]
  security_group_id = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_instance_egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.instance_security_group.id
}


module "chef_bootstrap" {
  source = "git@github.com:theorchard/terraform-chef-bootstrap.git?ref=3.1.0"

  chef_role         = "prod_jump_box"
  aws_iam_role_id   = aws_iam_role.instance_iam_role.name
  aws_instance_name = "${var.environment}-${var.service_name}"
}

resource "aws_instance" "jump_box" {
  ami                         = data.aws_ami.debian.id
  key_name                    = data.aws_key_pair.orchard_admin.key_name
  monitoring                  = true
  subnet_id                   = data.aws_subnet.main.id
  vpc_security_group_ids      = [aws_security_group.instance_security_group.id]
  associate_public_ip_address = false
  iam_instance_profile        = aws_iam_instance_profile.iam_instance_profile.name
  instance_type               = var.instance_type
  ebs_optimized               = true
  user_data                   = module.chef_bootstrap.user_data_output
  disable_api_termination     = true

  metadata_options {
    http_endpoint = "enabled"
    http_tokens   = "required"
  }

  root_block_device {
    volume_type           = "gp3"
    volume_size           = var.disk_size
    delete_on_termination = false
    encrypted             = true
    kms_key_id            = data.aws_kms_alias.ebs_key.target_key_arn
  }

  tags = {
    Name         = "${var.environment}-${var.service_name}"
    map-migrated = "d-server-03qkedizrl4cn5"
  }

  volume_tags = merge(module.default_tags.tags, {
    Name         = "${var.environment}-${var.service_name}"
    map-migrated = "d-server-03qkedizrl4cn5"
  })

  lifecycle {
    ignore_changes = [
      ami,
      user_data,
    ]
  }
}

resource "aws_route53_record" "route53_record" {
  name    = "${var.environment}-${var.service_name}"
  zone_id = data.aws_route53_zone.route53_zone.zone_id
  type    = "A"
  ttl     = "60"
  records = [aws_instance.jump_box.private_ip]
}