resource "aws_security_group" "instance_security_group" {
  name        = "${var.environment}-${var.service_name}-instance-security-group"
  description = "Instance security group for ${var.environment}-${var.service_name}"
  vpc_id      = var.vpc_id

  tags = {
    eiso-exception = "aws.08.30"
    environment    = var.environment
    service_name   = var.service_name
    terraformed    = true
  }
}

resource "aws_security_group_rule" "allow_ssh" {
  type              = "ingress"
  from_port         = var.ssh_port
  to_port           = var.ssh_port
  protocol          = "TCP"
  cidr_blocks       = var.ssh_ingress_cidr_blocks
  security_group_id = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_backups" {
  count                    = var.allow_backups ? 1 : 0
  type                     = "ingress"
  from_port                = var.backup_port
  to_port                  = var.backup_port
  protocol                 = "TCP"
  source_security_group_id = var.backup_ingress_security_group_id
  security_group_id        = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_bolt" {
  count             = var.allow_bolt ? 1 : 0
  type              = "ingress"
  from_port         = var.bolt_port
  to_port           = var.bolt_port
  protocol          = "TCP"
  cidr_blocks       = concat(var.bolt_ingress_cidr_blocks, [data.aws_vpc.current_vpc.cidr_block])
  security_group_id = aws_security_group.instance_security_group.id
}

# Only allow intra-group clustering access
resource "aws_security_group_rule" "allow_neo4j_clustering" {
  count             = length(var.neo4j_clustering_ports)
  type              = "ingress"
  from_port         = var.neo4j_clustering_ports[count.index]
  to_port           = var.neo4j_clustering_ports[count.index]
  protocol          = "TCP"
  self              = true
  security_group_id = aws_security_group.instance_security_group.id
}

resource "aws_security_group_rule" "allow_instance_egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.instance_security_group.id
}