module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=2.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
  team_name          = var.team_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

provider "aws" {
  region  = var.aws_region
  alias   = "networking"
  profile = "networking"

  default_tags {
    tags = module.default_tags.tags
  }
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "qa-supply-chain-terraform-state"
    key     = "qa/youtube-video-claiming/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

module "vpc_info" {
  source      = "git@github.com:theorchard/terraform-vpc-info.git//?ref=3.1.0"
  environment = var.environment
}

# Common sentry project
module "sentry_project" {
  source             = "git@github.com:theorchard/terraform-sentry.git//?ref=5.0.0"
  service_name       = var.service_name
  application_family = var.application_family
  environment        = var.environment
  teams              = [var.environment]
  platform           = "php"
}

# Common secrets
module "youtube_video_claiming_secrets" {
  source   = "git@github.com:theorchard/terraform-secrets-manager.git//?ref=1.5.1"
  for_each = toset(var.secrets_manager_secret_names_for_youtube_video_claiming)

  application_family = var.application_family
  environment        = var.environment
  service_name       = var.service_name
  secret_name        = each.value
}

data "aws_iam_policy_document" "bacon_shared_secrets_policy" {
  statement {
    effect = "Allow"

    actions = [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetResourcePolicy",
      "secretsmanager:ListSecretVersionIds",
    ]

    resources = [
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}/*",
      "arn:aws:secretsmanager:${var.aws_region}:${data.aws_caller_identity.current.account_id}:secret:${var.environment}/${var.service_name}",
    ]
  }
}

resource "aws_iam_policy" "bacon_shared_secrets_policy" {
  name   = "SecretsManager-${var.environment}-${var.service_name}-shared-policy"
  policy = data.aws_iam_policy_document.bacon_shared_secrets_policy.json

  tags = module.default_tags.tags
}

# SQS queues
module "bacon_queues" {
  source   = "git@github.com:theorchard/terraform-sqs.git//?ref=2.4.1"
  for_each = local.bacon_queues

  environment       = var.environment
  custom_queue_name = "${var.environment}_${each.key}"

  application_family = var.application_family
  sqs_message_retention_seconds = lookup(
    merge(local.bacon_queue_defaults, each.value),
    "sqs_message_retention_seconds"
  )
  sqs_max_message_size = lookup(
    merge(local.bacon_queue_defaults, each.value),
    "sqs_max_message_size"
  )
  sqs_receive_wait_time_seconds = 0
  sqs_delay_seconds             = 0
  sqs_visibility_timeout_seconds = lookup(
    merge(local.bacon_queue_defaults, each.value),
    "sqs_visibility_timeout_seconds"
  )
}

data "aws_iam_policy_document" "bacon_sqs_runtime_policy" {
  statement {
    effect = "Allow"

    actions = [
      "sqs:SetQueueAttributes",
      "sqs:GetQueueAttributes",
      "sqs:GetQueueUrl",
      "sqs:ListQueues",
      "sqs:SendMessageBatch",
      "sqs:SendMessage",
      "sqs:CreateQueue",
      "sqs:DeleteMessage",
      "sqs:ReceiveMessage",
      "sqs:PurgeQueue",
    ]

    resources = [
      "arn:aws:sqs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:${var.environment}_bacon_*",
    ]
  }

  statement {
    actions = [
      "sqs:GetQueueAttributes",
      "sqs:ListQueues"
    ]

    resources = [
      "arn:aws:sqs:${var.aws_region}:${data.aws_caller_identity.current.account_id}:*",
    ]
  }
}

resource "aws_iam_policy" "bacon_sqs_runtime_policy" {
  name   = "SQS-${var.environment}-bacon-runtime-policy"
  policy = data.aws_iam_policy_document.bacon_sqs_runtime_policy.json

  tags = module.default_tags.tags
}

# Memcahe
data "aws_route53_zone" "route53_zone" {
  name = "qa-supply-chain.theorchard.io."
}

data "aws_route53_zone" "networking_route53_zone" {
  provider = aws.networking
  name     = "theorchard.io"
}

module "elasticache" {
  source = "git@github.com:theorchard/terraform-elasticache.git//?ref=4.0.0"

  providers = {
    aws.dns = aws.networking
  }

  environment                      = var.environment
  application_family               = var.application_family
  service_name                     = var.service_name
  cache_engine                     = "memcached"
  cache_subnet_group_name          = "${var.environment}-elasticache-subnet-group"
  memcached_engine_version         = "1.6.6"
  cache_node_count                 = 1
  cache_node_type                  = "cache.t4g.micro"
  cache_parameter_group_name       = "default.memcached1.6"
  vpc_id                           = module.vpc_info.vpc_id
  route53_record_creation_enabled  = true
  override_route53_zone_id         = data.aws_route53_zone.route53_zone.zone_id
  networking_route53_zone_id       = data.aws_route53_zone.networking_route53_zone.id
  cache_transit_encryption_enabled = false
}