provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-songwhip-terraform-state"
    key     = "qa/fivetran-proxy/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source = "git@github.com:theorchard/terraform-vpc-info.git?ref=1.0.0"

  environment = var.environment
}

data "aws_route53_zone" "songwhip" {
  name = "aws-staging.songwhip.com"
}

module "fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=6.5.0"

  providers = {
    aws.dns = aws
  }

  environment                     = var.environment
  service_name                    = var.service_name
  application_family              = var.application_family
  secrets_manager_service_name    = var.service_name
  non_ecr_image                   = "086679231553.dkr.ecr.${var.aws_region}.amazonaws.com/docker-ssh-proxy:latest"
  aws_region                      = var.aws_region
  commit_sha                      = "latest"
  container_port                  = "2222"
  task_type                       = "worker"
  health_check_command            = "echo 'fivetran proxy'"
  desired_task_count              = 2
  task_cpu                        = 1024
  task_memory                     = 2048
  maximum_capacity                = 2
  minimum_capacity                = 2
  vpc_id                          = module.vpc_info.vpc_id
  additional_lb_target_group_arns = [aws_lb_target_group.fivetran_proxy_ecs_nlb_tg.arn]
  splitio_enabled                 = false
  ows_machine_to_machine_enabled  = false

  fargate_service_subnets = module.vpc_info.default_private_subnet_ids

  environment_variables = [
    {
      Environment = var.environment
    },
    {
      SERVICE_NAME = var.service_name
    },
    {
      PERMIT_DB_HOST = "qa-songwhip-api.cluster-ch72m6xtmre9.us-east-1.rds.amazonaws.com:5432"
    },
    {
      PROXY_USER = "fivetran"
    },
  ]
}

resource "aws_security_group" "fivetran_proxy_ecs_nlb_sg" {
  name        = "fivetran-proxy-ecs-nlb-sg"
  description = "Security group for Fivetran Proxy ECS NLB"
  vpc_id      = module.vpc_info.vpc_id

  ingress {
    description = "Allow all inbound traffic from the VPC"
    from_port   = 2222
    to_port     = 2222
    protocol    = "tcp"
    cidr_blocks = [
      "35.234.176.144/29", # Fivetran CIDR Block
    ]
  }

  egress {
    description = "Allow all outbound traffic to the VPC"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [
      "0.0.0.0/0",
    ]
  }

  tags = merge(local.tags, {
    "eiso-exception" = "aws.08.30"
  })
}

resource "aws_security_group_rule" "fivetran_proxy_task_allow_inbound_from_nlb" {
  type                     = "ingress"
  from_port                = 2222
  to_port                  = 2222
  protocol                 = "tcp"
  source_security_group_id = aws_security_group.fivetran_proxy_ecs_nlb_sg.id
  security_group_id        = module.fargate_environment.fargate_security_group_id
}

resource "aws_lb" "fivetran_proxy_ecs_nlb" {
  name               = "fivetran-proxy"
  internal           = false
  load_balancer_type = "network"
  security_groups    = [aws_security_group.fivetran_proxy_ecs_nlb_sg.id]
  subnets            = module.vpc_info.default_public_subnet_ids

  enable_cross_zone_load_balancing = true

  access_logs {
    enabled = true
    bucket  = "${var.environment}-songwhip-lb-logs"
    prefix  = "${var.environment}-${var.service_name}-nlb"
  }

  tags = local.tags
}

resource "aws_lb_listener" "fivetran_proxy_ecs_nlb_listener" {
  load_balancer_arn = aws_lb.fivetran_proxy_ecs_nlb.arn
  port              = 2222
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.fivetran_proxy_ecs_nlb_tg.arn
  }

  tags = local.tags
}

resource "aws_lb_target_group" "fivetran_proxy_ecs_nlb_tg" {
  name        = "fivetran-proxy"
  port        = 2222
  protocol    = "TCP"
  vpc_id      = module.vpc_info.vpc_id
  target_type = "ip"

  health_check {
    healthy_threshold   = 3
    unhealthy_threshold = 3
    interval            = 10
    port                = "traffic-port"
    protocol            = "TCP"
  }

  deregistration_delay = "300"

  tags = local.tags
}

module "fargate_service_dashboard" {
  source                            = "git@github.com:theorchard/terraform-datadog.git//modules/service//?ref=6.18.2"
  environment                       = var.environment
  environment_type                  = "fargate"
  service_name                      = var.service_name
  application_family                = var.application_family
  service_4xx_monitor_enabled       = false
  service_5xx_monitor_enabled       = false
  service_cpu_monitor_silenced      = true
  healthy_tasks_monitor_silenced    = true
  notification_endpoints            = "@slack-devops" # This is temp
  escalation_notification_endpoints = "@slack-devops" # This is temp
}

module "fivetran_proxy_secrets_manager" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.3"
  for_each = toset(var.sshd_host_fingerprints_secret_names)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}