module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.application_family
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "prod/sonar/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"

  environment = var.environment
}

data "aws_s3_bucket" "lb_log_bucket" {
  bucket = "${var.environment}-${var.account_group}-lb-logs"
}

data "aws_ec2_managed_prefix_list" "prefix_lists" {
  for_each = var.prefix_lists_to_allow_ingress_to_lb
  name     = each.value
}

data "aws_route53_zone" "shared_orchard_zone" {
  name = "shared.theorchard.io"
}

data "aws_route53_zone" "route53_zone_networking" {
  provider = aws.networking

  name = "theorchard.io."
}

data "aws_acm_certificate" "theorchard_io_certificate" {
  domain   = "*.theorchard.io"
  statuses = ["ISSUED"]
}

data "aws_s3_bucket" "logging_bucket_waf" {
  bucket = "aws-waf-logs-${var.environment}-orcd"
}

module "custom_waf" {
  source            = "git@github.com:theorchard/terraform-aws-waf.git//?ref=2.0.2"
  environment       = var.environment
  service_name      = var.service_name
  aws_region        = var.aws_region
  count_waf_enabled = false
  block_waf_enabled = true
  excluded_rules = [
    "SizeRestrictions_BODY",
    "CrossSiteScripting_BODY",
    "SizeRestrictions_QUERYSTRING",
  ]
}

resource "aws_wafv2_web_acl_logging_configuration" "waf_block_web_acl_logging_configuration" {
  log_destination_configs = [data.aws_s3_bucket.logging_bucket_waf.arn]
  resource_arn            = module.custom_waf.waf_blocking_arn_output

  redacted_fields {
    single_header {
      name = "authorization"
    }
  }

  redacted_fields {
    single_header {
      name = "session"
    }
  }

  redacted_fields {
    single_header {
      name = "cookie"
    }
  }
}

module "fargate_sonarqube" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.4.3"

  providers = {
    aws.dns = aws
  }

  environment                              = var.environment
  service_name                             = var.service_name
  application_family                       = var.application_family
  aws_region                               = var.aws_region
  commit_sha                               = "latest"
  container_port                           = var.container_port
  task_cpu                                 = 2048
  task_memory                              = 4096
  load_balancer_access_logs_s3_bucket_name = data.aws_s3_bucket.lb_log_bucket.id
  ows_machine_to_machine_enabled           = false
  vpc_id                                   = module.vpc_info.vpc_id
  fargate_service_subnets                  = module.vpc_info.default_private_subnet_ids
  load_balancer_subnets                    = module.vpc_info.default_private_subnet_ids
  health_check_path                        = "/"
  override_route53_zone_id                 = data.aws_route53_zone.shared_orchard_zone.zone_id
  ulimit_nofile_soft_limit                 = 65535
  custom_waf_arn                           = module.custom_waf.waf_blocking_arn_output

  secrets = [
    {
      SONAR_JDBC_USERNAME = "${var.environment}/${var.service_name}/SONAR_JDBC_USERNAME"
    },
    {
      SONAR_JDBC_PASSWORD = "${var.environment}/${var.service_name}/SONAR_JDBC_PASSWORD"
    },
  ]
}

resource "aws_security_group_rule" "allow_inbound_access_to_lb" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  prefix_list_ids   = [for list in data.aws_ec2_managed_prefix_list.prefix_lists : list.id]
  security_group_id = module.fargate_sonarqube.fargate_load_balancer_security_group_id
}

resource "aws_lb_listener_certificate" "additional_certificate" {
  listener_arn    = module.fargate_sonarqube.fargate_load_balancer_https_listener_arn
  certificate_arn = data.aws_acm_certificate.theorchard_io_certificate.arn
}

module "secrets_sonarqube" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names)

  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
  application_family = var.application_family
}

module "sonarqube_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=6.18.1"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  application_family                = var.application_family
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  healthy_tasks_monitor_enabled     = true
  service_cpu_monitor_enabled       = true
  notification_endpoints            = "@slack-devops-internal-alerts"
  escalation_notification_endpoints = "@slack-devops-internal-alerts"
}

resource "aws_db_subnet_group" "db_subnet_group_sonarqube" {
  name       = "${var.environment}-${var.service_name}-rds-subnet-group"
  subnet_ids = module.vpc_info.default_private_subnet_ids
}

resource "aws_db_parameter_group" "db_parameter_group_sonarqube" {
  name   = "${var.environment}-${var.service_name}-aurora-postgresql13"
  family = "aurora-postgresql13"
}

resource "aws_rds_cluster_parameter_group" "cluster_parameter_group_sonarqube" {
  name   = "${var.environment}-${var.service_name}-aurora-postgresql13"
  family = "aurora-postgresql13"
}

resource "aws_db_parameter_group" "db_parameter_group_sonarqube_version17" {
  name   = "${var.environment}-${var.service_name}-aurora-postgresql17"
  family = "aurora-postgresql17"
}

resource "aws_rds_cluster_parameter_group" "cluster_parameter_group_sonarqube_version17" {
  name   = "${var.environment}-${var.service_name}-aurora-postgresql17"
  family = "aurora-postgresql17"
}

module "rds_sonarqube" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=8.0.0"

  providers = {
    aws.dns = aws
  }

  environment                               = var.environment
  rds_engine                                = "aurora-postgresql"
  rds_engine_version                        = "17"
  service_name                              = var.service_name
  vpc_id                                    = module.vpc_info.vpc_id
  override_route53_zone_id                  = data.aws_route53_zone.shared_orchard_zone.zone_id
  rds_db_subnet_group_name                  = aws_db_subnet_group.db_subnet_group_sonarqube.name
  rds_cluster_instance_parameter_group_name = aws_db_parameter_group.db_parameter_group_sonarqube_version17.name
  rds_db_cluster_parameter_group_name       = aws_rds_cluster_parameter_group.cluster_parameter_group_sonarqube_version17.name
  rds_cluster_instance_class                = "db.r6g.large"
  rds_cluster_instance_count                = "1"
  rds_master_username                       = "sonar_rds_admin"
  rds_master_password                       = "s0mePass!changme"
  rds_availability_zones                    = ["us-east-1a", "us-east-1c"]
  enabled_cloudwatch_logs_exports           = ["postgresql"]
  application_family                        = var.application_family

  custom_kms_key_enabled = false
}

resource "aws_route53_record" "theorchard_io_cname_record" {
  provider = aws.networking

  name    = "prod-${var.service_name}.theorchard.io"
  type    = "CNAME"
  ttl     = 300
  zone_id = data.aws_route53_zone.route53_zone_networking.zone_id
  records = [module.fargate_sonarqube.non_prod_fargate_service_route53_record_fqdn_output]
}