# Improvements that I've already thought of
# - do a dedicated security group here to replace using the default one
# - Make the rules and rule associations more dynamic, too much copy-pasta here

provider "aws" {
  region = var.aws_region
}

# Terraform backends cannot contain interpolations
terraform {
  backend "s3" {
    bucket  = "dev-orcd-terraform-state"
    key     = "dev/terraform-route53-resolver/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_subnet_ids" "subnets" {
  vpc_id = var.vpc_id
  tags = {
    tier = "private"
  }
}



data "aws_subnet" "eachsubnet" {
  for_each = data.aws_subnet_ids.subnets.ids
  id       = each.value
}


# Security group for resolver endpoints
resource "aws_security_group" "resolver_endpoint_security_group" {
  name        = "${var.environment}-${var.vpc_id}-resolver-security-group"
  description = "Endpoint security group for ${var.environment} ${var.vpc_id}"
  vpc_id      = var.vpc_id

  tags = {
    environment = var.environment
    terraformed = true
    name        = "${var.environment}-${var.vpc_id}-resolver-security-group"
  }
}

resource "aws_security_group_rule" "allow_outbound_tcp_to_orch_dns" {
  type              = "egress"
  from_port         = "53"
  to_port           = "53"
  protocol          = "TCP"
  cidr_blocks       = var.orcd_resolver_cidrs
  security_group_id = aws_security_group.resolver_endpoint_security_group.id
}

resource "aws_security_group_rule" "allow_outbound_udp_to_orch_dns" {
  type              = "egress"
  from_port         = "53"
  to_port           = "53"
  protocol          = "UDP"
  cidr_blocks       = var.orcd_resolver_cidrs
  security_group_id = aws_security_group.resolver_endpoint_security_group.id
}




resource "aws_route53_resolver_endpoint" "resolver" {
  name      = "${var.environment} AWS resolverforwarder"
  direction = "OUTBOUND"

  #security_group_ids = ["sg-351b5751"]
  security_group_ids = [aws_security_group.resolver_endpoint_security_group.id]

  dynamic ip_address {
    for_each = data.aws_subnet_ids.subnets.ids
    content {
      subnet_id = ip_address.value
    }
  }
  # ip_address {
  #   subnet_id = "subnet-0285b8fc992cfc35a"
  # }
  # ip_address {
  #   subnet_id = "subnet-b649dfef"
  # }
  # ip_address {
  #   subnet_id = "subnet-44c19a21"
  # }
  tags = {
    Environment = "dev"
    terraformed = "true"
  }
}

# Rules to forward orchard domains to NY Infoblox
resource "aws_route53_resolver_rule" "theorchardlocal" {
  domain_name          = "theorchard.local"
  name                 = "theorchard_local"
  rule_type            = "FORWARD"
  resolver_endpoint_id = aws_route53_resolver_endpoint.resolver.id

  dynamic target_ip {
    for_each = var.orcd_nydnsresolvers
    content {
      ip = target_ip.value
    }
  }

  tags = {
    Environment = "dev"
    terraformed = "true"
  }
}

resource "aws_route53_resolver_rule_association" "theorchardlocalassociation" {
  resolver_rule_id = aws_route53_resolver_rule.theorchardlocal.id
  vpc_id           = var.vpc_id
}

resource "aws_route53_resolver_rule" "devorch" {
  domain_name          = "devorch.com"
  name                 = "devorch_com"
  rule_type            = "FORWARD"
  resolver_endpoint_id = aws_route53_resolver_endpoint.resolver.id

  dynamic target_ip {
    for_each = var.orcd_nydnsresolvers
    content {
      ip = target_ip.value
    }
  }

  tags = {
    Environment = "dev"
    terraformed = "true"
  }
}

resource "aws_route53_resolver_rule_association" "devorchassociation" {
  resolver_rule_id = aws_route53_resolver_rule.devorch.id
  vpc_id           = var.vpc_id
}