locals {
  # Managed IAM policies to attach to on-prem user
  on_prem_managed_iam_policies = [
    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
    "arn:aws:iam::aws:policy/CloudWatchFullAccess",
    var.daemon_video_service_owsrequest_policy_arn_output,
    var.s3_raw_dir_putonly_policy_output,
    var.daemon_video_stepfunctions_policy_output,
  ]

  iam_user_managed_policies = [
    var.s3_mezzanine_dir_readonly_policy_output,
    var.s3_raw_dir_readonly_policy_output,
    var.s3_thumbnails_dir_readonly_policy_output,
    var.ows_video_browser_upload_assume_role_policy_output,
    var.ows_video_service_owsrequest_policy_arn_output,
    var.ows_video_stepfunctions_policy_output,
    var.s3_list_bucket_policy_output,
    var.secrets_manager_datadog_policy,
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecretsManager-${var.env}-ows-machine-to-machine-policy",
    "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/SecretsManager-${var.env}-ows-video-policy",
  ]
}

provider "aws" {
  region = var.region
}

# Datadog provider
provider "datadog" {
  api_key = data.aws_secretsmanager_secret_version.datadog_api.secret_string
  app_key = data.aws_secretsmanager_secret_version.datadog_app_key.secret_string
}

terraform {
  backend "s3" {
    bucket  = "orcd-terraform-state"
    key     = "prod/video/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_caller_identity" "current" {}

data "aws_secretsmanager_secret" "datadog_api" {
  name = "${var.env}/datadog/DD_API_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_api" {
  secret_id = data.aws_secretsmanager_secret.datadog_api.id
}

data "aws_secretsmanager_secret" "datadog_app_key" {
  name = "${var.env}/datadog/DD_APP_KEY"
}

data "aws_secretsmanager_secret_version" "datadog_app_key" {
  secret_id = data.aws_secretsmanager_secret.datadog_app_key.id
}

# Set up rds master password.
data "aws_secretsmanager_secret" "rds_master_username" {
  name = "${var.env}/ows-video/rds_master_username"
}

data "aws_secretsmanager_secret_version" "rds_master_username" {
  secret_id = data.aws_secretsmanager_secret.rds_master_username.id
}

data "aws_secretsmanager_secret" "rds_master_password" {
  name = "${var.env}/ows-video/rds_master_password"
}

data "aws_secretsmanager_secret_version" "rds_master_password" {
  secret_id = data.aws_secretsmanager_secret.rds_master_password.id
}

#
# Run:
#   1. `terraform init`
#   2. `terraform plan`
#   3. `terraform apply -target module.ows_video_rds`
# Be sure to store your DB_USERNAME and DB_PASSWORD in your
# password manager of choice.
#
module "ows_video_rds" {
  source = "git@github.com:theorchard/terraform-rds.git//?ref=1.0.0"

  environment                = var.env
  service_name               = "ows-video"
  rds_cluster_instance_class = "db.r4.large"
  rds_cluster_instance_count = "1"
  rds_db_subnet_group_name   = "vpc-orchard"
  rds_vpc_security_group_ids = ["sg-21f1ed44"]
  rds_master_username        = data.aws_secretsmanager_secret_version.rds_master_username.secret_string
  rds_master_password        = data.aws_secretsmanager_secret_version.rds_master_password.secret_string
}

#
# Run:
#   1. terraform plan -target module.s3_video_bucket
#   2. terraform apply -target module.s3_video_bucket
#
module "s3_video_bucket" {
  source                   = "../modules/s3"
  environment              = var.env
  video_assets_bucket_cors = var.video_assets_bucket_cors_policy
  logging_bucket           = "prod-orcd-s3-logs"
}

module "rekognition_daemon_video" {
  source       = "../modules/rekognition"
  environment  = var.env
  service_name = "daemon-video"
}

#
# Run:
#   1. terraform plan -target module.ows_video_service_owsrequest
#   2. terraform apply -target module.ows_video_service_owsrequest
#
module "ows_video_service_owsrequest" {
  source           = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.0"
  environment_name = var.env
  service_name     = "ows-video"
}

#
# Run:
#   1. terraform plan -target module.daemon_video_service_owsrequest
#   2. terraform apply -target module.daemon_video_service_owsrequest
#   3. terraform output -module=daemon_video_service_owsrequest
#   4. Paste output of step 3 into your terraform.tfvars file with the variable name of
#      `daemon_video_service_owsrequest_policy_arn_output`.
module "daemon_video_service_owsrequest" {
  source = "git@github.com:theorchard/terraform-owsrequest.git//?ref=1.0.0"

  environment_name = var.env
  service_name     = "daemon-video"
}

#
# Run:
#   1. Connect to DB with master creds and create service db username and password. Add to tfvars.
#   2. Share creds securely with systems.
#   3. terraform output -module=ows_video_rds
#   4. replace DB_HOST in terraform.tfvars
#   5. terraform output -module=s3_video_bucket
#   6. replace s3_mezzanine_readonly_policy_output and s3_raw_putonly_policy_output in tfvars.
#   7. terraform plan -target module.ows_video_service_environment
#   8. terraform apply -target module.ows_video_service_environment
#
module "ows_video_service_environment" {
  source = "git@github.com:theorchard/terraform-elasticbeanstalk.git//?ref=1.0"

  environment      = var.env
  service_name     = "ows-video"
  update_max_batch = "1"
  vpc_elb_subnets  = "subnet-cb4dbae0,subnet-5366ef24"
  vpc_subnets      = "subnet-cb4dbae0,subnet-5366ef24"
  vpc_id           = "vpc-7f0e841a"
  iam_managed_policy_attachments = [
    var.s3_mezzanine_dir_readonly_policy_output,
    var.s3_raw_dir_readonly_policy_output,
    var.s3_thumbnails_dir_readonly_policy_output,
    var.ows_video_browser_upload_assume_role_policy_output,
    var.ows_video_service_owsrequest_policy_arn_output,
    var.ows_video_stepfunctions_policy_output,
    var.s3_list_bucket_policy_output,
    var.secrets_manager_datadog_policy,
  ]
  aws_route53_zone_id                        = "Z2RSKZ9M7TJ9Z"
  launchconfiguration_keypair                = var.CONFIG_KEYPAIR
  load_balancer_listener_port                = "443"
  load_balancer_listener_protocol            = "HTTPS"
  load_balancer_ssl_certificate_arn          = "arn:aws:acm:us-east-1:437795906767:certificate/a76e4883-28aa-4062-a4cc-c06b8012ae28"
  notification_endpoints                     = "video.distro.eng@theorchard.com"
  process_port                               = "80"
  process_protocol                           = "HTTP"
  process_instance_health_check_path         = "/hello/"
  launchconfiguration_instance_type          = "t3.medium"
  trigger_measure_name                       = "CPUUtilization"
  trigger_period                             = "1"
  trigger_breach_duration                    = "10"
  trigger_statistic                          = "Average"
  trigger_unit                               = "Percent"
  trigger_upper_threshold                    = "75"
  trigger_lower_threshold                    = "50"
  launchconfiguration_monitoring_interval    = "1 minute"
  deployment_batch_size_type                 = "Percentage"
  deployment_batch_size                      = "100"
  asg_cooldown                               = "60"
  asg_min_size                               = "2"
  asg_max_size                               = "4"
  deployment_timeout                         = "3600"
  update_type                                = "Immutable"
  deployment_update_type                     = "RollingWithAdditionalBatch"
  elb_connection_draining_enabled            = "true"
  managed_update_weekly_instance_replacement = "true"

  environment_variables = [
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "Environment"
      value     = var.env
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "SENTRY_DSN"
      value     = var.OWS_SENTRY_DSN
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "LOGGER_DSN"
      value     = var.LOGGER_DSN
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "VIDEO_DB_HOST"
      value     = var.VIDEO_DB_HOST
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "VIDEO_DB_NAME"
      value     = "ows_video"
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "VIDEO_DB_PORT"
      value     = "3306"
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "AR_DB_NAME"
      value     = var.AR_DB_NAME
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "AR_DB_HOST"
      value     = var.AR_DB_HOST
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "AR_DB_PORT"
      value     = var.AR_DB_PORT
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "UPLOAD_RAW_ROLE_ARN"
      value     = var.s3_raw_dir_browser_upload_role_arn_output
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "VIDEO_INGESTION_WORKFLOW_STATE_MACHINE_ARN"
      value     = var.video_ingestion_workflow_state_machine_arn_output
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "VIDEO_APPROVAL_WORKFLOW_STATE_MACHINE_ARN"
      value     = var.video_approval_workflow_state_machine_arn_output
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "WOWZA_URL"
      value     = var.wowza_url
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "DATADOG_ENV"
      value     = "${var.env}-ows-video"
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "UPLOAD_RAW_DIR_ROLE_DURATION_SECONDS"
      value     = var.UPLOAD_RAW_DIR_ROLE_DURATION_SECONDS
    },
  ]
}

# Terraform ows-video fargate environment
module "ows_video_service_fargate_environment" {
  source = "git@github.com:theorchard/terraform-fargate.git//?ref=1.7.11"

  environment                              = var.env
  service_name                             = "ows-video"
  aws_region                               = "us-east-1"
  commit_sha                               = "latest"
  container_port                           = "8080"
  task_type                                = "web_service"
  desired_task_count                       = 2
  task_cpu                                 = 1024
  task_memory                              = 2048
  maximum_capacity                         = 6
  minimum_capacity                         = 2
  health_check_path                        = "/hello/"
  route53_zone_id                          = "Z2RSKZ9M7TJ9Z"
  load_balancer_access_logs_s3_bucket_name = "orch-elb-logs"
  vpc_id                                   = "vpc-7f0e841a"
  https_listener_certificate_id            = "a76e4883-28aa-4062-a4cc-c06b8012ae28"
  target_group_stickiness_enabled          = true
  target_group_cookie_duration             = "300"
  max_session_duration                     = "43200"

  # Overriding here to add in the graphql_switchboard_vpc (10.110.0.0/16) private subnets
  prod_https_listener_allow_cidr_blocks = [
    "192.168.31.0/24",
    "192.168.32.0/24",
    "192.168.33.0/24",
    "192.168.40.0/22",
    "10.30.0.0/22",
    "10.40.0.0/22",
    "10.110.0.0/24",
    "10.110.1.0/24",
  ]
  iam_managed_policy_attachments = [
    var.s3_mezzanine_dir_readonly_policy_output,
    var.s3_raw_dir_readonly_policy_output,
    var.s3_thumbnails_dir_readonly_policy_output,
    var.ows_video_browser_upload_assume_role_policy_output,
    var.ows_video_service_owsrequest_policy_arn_output,
    var.ows_video_stepfunctions_policy_output,
    var.s3_list_bucket_policy_output,
    var.secrets_manager_datadog_policy,
  ]

  fargate_service_subnets = [
    "subnet-067a6b45b079d7296",
    "subnet-043d235081c966332",
  ]

  load_balancer_subnets = [
    "subnet-067a6b45b079d7296",
    "subnet-043d235081c966332",
  ]

  environment_variables = [
    {
      Environment = var.env
    },
    {
      DATADOG_ENV = "${var.env}-ows-video"
    },
    {
      DD_LOGS_INJECTION = "true"
    },
    {
      LOGGER_DSN = "https://prod-fluentd-applications.theorchard.io:8888/application"
    },
    {
      AR_DB_HOST = "ar-db.theorchard.com"
    },
    {
      AR_DB_NAME = "art_relations"
    },
    {
      AR_DB_PORT = "3306"
    },
    {
      DD_DB_HOST = "dd-db.theorchard.com"
    },
    {
      DD_DB_NAME = "direct_delivery"
    },
    {
      DD_DB_PORT = "3306"
    },
    {
      UPLOAD_RAW_DIR_ROLE_DURATION_SECONDS = "43200"
    },
    {
      UPLOAD_RAW_ROLE_ARN = "arn:aws:iam::437795906767:role/prod-ows-video-browser-upload-role"
    },
    {
      VIDEO_APPROVAL_WORKFLOW_STATE_MACHINE_ARN = "arn:aws:states:us-east-1:437795906767:stateMachine:prod_video_approval_workflow"
    },
    {
      VIDEO_DB_HOST = "prod-ows-video.cluster-cb22xqmk0y0q.us-east-1.rds.amazonaws.com"
    },
    {
      VIDEO_DB_NAME = "ows_video"
    },
    {
      VIDEO_DB_PORT = "3306"
    },
    {
      VIDEO_INGESTION_WORKFLOW_STATE_MACHINE_ARN = "arn:aws:states:us-east-1:437795906767:stateMachine:prod_video_ingestion_workflow"
    },
    {
      WOWZA_URL = "https://prod-aws-wowza.theorchard.com"
    },
  ]

  secrets = [
    {
      AWS_ACCESS_KEY_ID = "${var.env}/ows-video/AWS_ACCESS_KEY_ID"
    },
    {
      AWS_SECRET_ACCESS_KEY = "${var.env}/ows-video/AWS_SECRET_ACCESS_KEY"
    },
    {
      SENTRY_DSN = "${var.env}/ows-video/SENTRY_DSN"
    },
    {
      CLOUDFRONT_KEY_PAIR_ID = "${var.env}/ows-video/CLOUDFRONT_KEY_PAIR_ID"
    },
    {
      CLOUDFRONT_PRIVATE_KEY = "${var.env}/ows-video/CLOUDFRONT_PRIVATE_KEY"
    },
  ]
}

resource "aws_iam_user" "ows_video_iam_user" {
  name = "${var.env}-ows-video-user"
  tags = {
    terraformed = true
  }

  depends_on = [
    module.ows_video_service_fargate_environment
  ]
}

resource "aws_iam_user_policy_attachment" "iam_user_policy_attachment" {
  user       = aws_iam_user.ows_video_iam_user.name
  count      = length(local.iam_user_managed_policies)
  policy_arn = local.iam_user_managed_policies[count.index]

  depends_on = [
    module.ows_video_service_fargate_environment
  ]
}

#
# Run:
#   1. terraform plan -target module.daemon_video_service_environment
#   2. terraform output -module=video_mediaconvert
#   3. Take the output from step 2 and add it to terraform.tfvars.
#   4. terraform apply -target module.daemon_video_service_environment
#
module "daemon_video_service_environment" {
  source = "git@github.com:theorchard/terraform-elasticbeanstalk.git//?ref=1.0"

  environment      = var.env
  service_name     = "daemon-video"
  environment_tier = "Worker"
  update_max_batch = "1"
  vpc_elb_subnets  = "subnet-cb4dbae0,subnet-5366ef24"
  vpc_subnets      = "subnet-cb4dbae0,subnet-5366ef24"
  vpc_id           = "vpc-7f0e841a"
  iam_managed_policy_attachments = [
    var.s3_raw_dir_rw_policy_output,
    var.s3_mezzanine_dir_rw_policy_output,
    var.s3_ingest_dir_rwd_policy_output,
    var.s3_thumbnails_dir_readonly_policy_output,
    var.s3_list_bucket_policy_output,
    var.rekognition_policy_output,
    var.daemon_video_service_owsrequest_policy_arn_output,
    var.daemon_video_stepfunctions_policy_output,
    var.video_mediaconvert_create_job_policy_arn_output,
    var.video_mediaconvert_get_job_policy_arn_output,
    var.video_mediaconvert_get_role_policy_arn_output,
    var.video_mediaconvert_pass_role_policy_arn_output,
    var.sqs_minimal_policy_arn_output,
  ]
  elb_v2_access_logs_s3_bucket               = "aws-logs-437795906767-us-east-1"
  notification_endpoints                     = "video.distro.eng@theorchard.com"
  process_instance_health_check_path         = ""
  launchconfiguration_instance_type          = "c5d.xlarge"
  trigger_measure_name                       = "CPUUtilization"
  trigger_period                             = "1"
  trigger_breach_duration                    = "10"
  trigger_statistic                          = "Average"
  trigger_unit                               = "Percent"
  trigger_upper_threshold                    = "100"
  trigger_lower_threshold                    = "0"
  launchconfiguration_monitoring_interval    = "1 minute"
  deployment_batch_size_type                 = "Percentage"
  deployment_batch_size                      = "100"
  asg_cooldown                               = "60"
  asg_min_size                               = "3"
  asg_max_size                               = "8"
  deployment_timeout                         = "3600"
  update_type                                = "Immutable"
  deployment_update_type                     = "RollingWithAdditionalBatch"
  managed_update_weekly_instance_replacement = "true"

  environment_variables = [
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "Environment"
      value     = var.env
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "SENTRY_DSN"
      value     = var.DAEMON_SENTRY_DSN
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "LOGGER_DSN"
      value     = var.LOGGER_DSN
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MEDIACONVERT_ROLE"
      value     = var.video_mediaconvert_role_arn_output
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MEDIACONVERT_URL"
      value     = var.MEDIACONVERT_URL
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MEDIACONVERT_QUEUE"
      value     = var.MEDIACONVERT_QUEUE
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "NUM_ACTIVITY_TASK_HANDLING_WORKERS"
      value     = var.NUM_ACTIVITY_TASK_HANDLING_WORKERS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_TIMEOUT_BETWEEN_RESOURCE_UTILIZATION_CHECKS_SECONDS"
      value     = var.MAX_TIMEOUT_BETWEEN_RESOURCE_UTILIZATION_CHECKS_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "CUSTOM_METRIC_CPU_USAGE_PERCENT"
      value     = var.CUSTOM_METRIC_CPU_USAGE_PERCENT
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "CUSTOM_METRIC_MEMORY_USAGE_PERCENT"
      value     = var.CUSTOM_METRIC_MEMORY_USAGE_PERCENT
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_ALLOWED_CPU_USAGE_PERCENT"
      value     = var.MAX_ALLOWED_CPU_USAGE_PERCENT
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_ALLOWED_MEMORY_USAGE_PERCENT"
      value     = var.MAX_ALLOWED_MEMORY_USAGE_PERCENT
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_TIMEOUT_BEFORE_PICKING_UP_WORK_SECONDS"
      value     = var.MAX_TIMEOUT_BEFORE_PICKING_UP_WORK_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_TIMEOUT_BETWEEN_PICKING_UP_WORK_AND_HANDLING_SECONDS"
      value     = var.MAX_TIMEOUT_BETWEEN_PICKING_UP_WORK_AND_HANDLING_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "MAX_TIMEOUT_AFTER_AWS_THROTTLING_EXCEPTION_SECONDS"
      value     = var.MAX_TIMEOUT_AFTER_AWS_THROTTLING_EXCEPTION_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "HEARTBEAT_PERIOD_SECONDS"
      value     = var.HEARTBEAT_PERIOD_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "HTTP_REQUEST_RETRY_PERIOD_SECONDS"
      value     = var.HTTP_REQUEST_RETRY_PERIOD_SECONDS
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "ACTIVITY_TASK_SQS_QUEUE_NAME"
      value     = var.daemon_video_activity_task_sqs_queue_name
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "ACTIVITY_ARN_PREFIX"
      value     = var.ACTIVITY_ARN_PREFIX
    },
    {
      namespace = "aws:elasticbeanstalk:application:environment"
      name      = "UPLOAD_FROM_BROWSER_TO_S3_TIMEOUT_THRESHOLD"
      value     = var.UPLOAD_FROM_BROWSER_TO_S3_TIMEOUT_THRESHOLD
    },
  ]
}

data "aws_autoscaling_groups" "prod_daemon_video_autoscaling_groups" {
  filter {
    name   = "key"
    values = ["Name"]
  }

  filter {
    name   = "value"
    values = ["prod-daemon-video"]
  }
}

resource "aws_autoscaling_policy" "prod_daemon_video_autoscaling_up_policy" {
  name                   = "prod_daemon_video_autoscaling_up_policy"
  scaling_adjustment     = 1
  adjustment_type        = "ChangeInCapacity"
  cooldown               = 120
  autoscaling_group_name = data.aws_autoscaling_groups.prod_daemon_video_autoscaling_groups.names[0]
}

resource "aws_autoscaling_policy" "prod_daemon_video_autoscaling_down_policy" {
  name                   = "prod_daemon_video_autoscaling_down_policy"
  scaling_adjustment     = -1
  adjustment_type        = "ChangeInCapacity"
  cooldown               = 60
  autoscaling_group_name = data.aws_autoscaling_groups.prod_daemon_video_autoscaling_groups.names[0]
}

resource "aws_cloudwatch_metric_alarm" "prod_daemon_video_cpu_or_memory_usage_autoscaling_up_trigger" {
  alarm_name          = "prod_daemon_video_cpu_or_memory_usage_autoscaling_up_trigger"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = "1"
  threshold           = "100"
  alarm_description   = "Scale up."
  alarm_actions       = [aws_autoscaling_policy.prod_daemon_video_autoscaling_up_policy.arn]
  metric_query {
    id          = "resource_usage_percent"
    expression  = "MAX([cpu_usage_percent / ${var.MAX_ALLOWED_CPU_USAGE_PERCENT}, memory_usage_percent / ${var.MAX_ALLOWED_MEMORY_USAGE_PERCENT}]) * 100"
    label       = "ResourceUsagePercent"
    return_data = "true"
  }
  metric_query {
    id = "cpu_usage_percent"
    metric {
      metric_name = var.CUSTOM_METRIC_CPU_USAGE_PERCENT
      namespace   = "ElasticBeanstalk/daemon-video"
      period      = "60"
      stat        = "Average"
      unit        = "Percent"
      dimensions = {
        Environment = "prod"
      }
    }
  }
  metric_query {
    id = "memory_usage_percent"
    metric {
      metric_name = var.CUSTOM_METRIC_MEMORY_USAGE_PERCENT
      namespace   = "ElasticBeanstalk/daemon-video"
      period      = "60"
      stat        = "Average"
      unit        = "Percent"
      dimensions = {
        Environment = "prod"
      }
    }
  }
}

resource "aws_cloudwatch_metric_alarm" "prod_daemon_video_cpu_or_memory_usage_autoscaling_down_trigger" {
  alarm_name          = "prod_daemon_video_cpu_or_memory_usage_autoscaling_down_trigger"
  comparison_operator = "LessThanOrEqualToThreshold"
  evaluation_periods  = "30"
  threshold           = "75"
  alarm_description   = "Scale down."
  alarm_actions       = [aws_autoscaling_policy.prod_daemon_video_autoscaling_down_policy.arn]
  metric_query {
    id          = "resource_usage_percent"
    expression  = "MAX([cpu_usage_percent / ${var.MAX_ALLOWED_CPU_USAGE_PERCENT}, memory_usage_percent / ${var.MAX_ALLOWED_MEMORY_USAGE_PERCENT}]) * 100"
    label       = "ResourceUsagePercent"
    return_data = "true"
  }
  metric_query {
    id = "cpu_usage_percent"
    metric {
      metric_name = var.CUSTOM_METRIC_CPU_USAGE_PERCENT
      namespace   = "ElasticBeanstalk/daemon-video"
      period      = "60"
      stat        = "Average"
      unit        = "Percent"
      dimensions = {
        Environment = "prod"
      }
    }
  }
  metric_query {
    id = "memory_usage_percent"
    metric {
      metric_name = var.CUSTOM_METRIC_MEMORY_USAGE_PERCENT
      namespace   = "ElasticBeanstalk/daemon-video"
      period      = "60"
      stat        = "Average"
      unit        = "Percent"
      dimensions = {
        Environment = "prod"
      }
    }
  }
}

module "video_state_machines" {
  source                                               = "../modules/step_functions"
  environment                                          = var.env
  video_ingestion_workflow_state_machine_execution_arn = var.video_ingestion_workflow_state_machine_execution_arn
  video_approval_workflow_state_machine_execution_arn  = var.video_approval_workflow_state_machine_execution_arn
}

#
# Run:
#   1. terraform apply -target module.s3_video_bucket
#   2. terraform output -module=s3_video_bucket
#   3. Take the output from step 2 and add it to terraform.tfvars.
#   4. terraform apply -target module.video_mediaconvert
#
module "video_mediaconvert" {
  source                                          = "../modules/mediaconvert"
  environment                                     = var.env
  s3_blank_dir_readonly_policy_output             = var.s3_blank_dir_readonly_policy_output
  s3_raw_dir_readonly_policy_output               = var.s3_raw_dir_readonly_policy_output
  s3_streamable_preview_dir_putonly_policy_output = var.s3_streamable_preview_dir_putonly_policy_output
  s3_thumbnails_dir_putonly_policy_output         = var.s3_thumbnails_dir_putonly_policy_output
  s3_mezzanine_dir_putonly_policy_output          = var.s3_mezzanine_dir_putonly_policy_output
}

# Run:
#   1. terraform apply -target module.s3_video_bucket
#   2. terraform output -module=s3_video_bucket
#   3. Take the output from step 2 and add it to terraform.tfvars.
#   4. terraform apply -target module.thumbnails_distribution
module "thumbnails_distribution" {
  source = "../modules/cloudfront"

  environment              = var.env
  video_assets_bucket_name = var.video_assets_bucket_name
  distribution_alias       = var.thumbnails_distribution_alias
  acm_certificate_arn      = var.thumbnails_acm_certificate_arn
  logging_bucket           = "prod-orcd-cloudfront-logs.s3.amazonaws.com"
}

# Run:
#   1. terraform apply -target module.video_sqs
#   2. terraform output -module=video_sqs
#   3. Take sqs_minimal_policy_arn_output from step 2
#      and paste into terraform.tfvars.
#
module "video_sqs" {
  source = "git@github.com:theorchard/terraform-sqs.git//?ref=2.0.1"

  environment                    = var.env
  queue_name                     = "daemon-video"
  sqs_delay_seconds              = 0
  sqs_max_message_size           = 131000
  sqs_message_retention_seconds  = 86400
  sqs_receive_wait_time_seconds  = 20
  sqs_visibility_timeout_seconds = 43200
  application_family = var.application_family
}

# Run:
#   1. terraform apply -target module.video_on_prem_sqs
#   2. terraform output -module=video_on_prem_sqs
#   3. Take sqs_minimal_policy_arn_output from step 2
#      and paste into terraform.tfvars.
#
module "video_on_prem_sqs" {
  source = "git@github.com:theorchard/terraform-sqs.git//?ref=2.0.1"

  environment                    = var.env
  queue_name                     = "daemon-video-on-prem"
  sqs_delay_seconds              = 0
  sqs_max_message_size           = 131000
  sqs_message_retention_seconds  = 86400
  sqs_receive_wait_time_seconds  = 20
  sqs_visibility_timeout_seconds = 43200
  application_family = var.application_family
}

# Run:
#   1. terraform apply -target module.on_prem_daemon_video_user_policy_attachment
#   Note: depends on output of video_on_prem_sqs.
module "on_prem_daemon_video_user_policy_attachment" {
  source = "../modules/attach_policy_to_user"

  policy_user = "${var.env}-daemon-video"
  policy_arn  = var.daemon_video_on_prem_sqs_policy_arn_output
}

# Run:
#   1. terraform apply -target module.on_prem_daemon_video_mezzanine_readonly_policy_attachement
#   Note: depends on output of s3_video_bucket
module "on_prem_daemon_video_mezzanine_readonly_policy_attachment" {
  source = "../modules/attach_policy_to_user"

  policy_user = "${var.env}-daemon-video"
  policy_arn  = var.s3_mezzanine_dir_readonly_policy_output
}

# Run:
#   1. terraform apply -target module.on_prem_daemon_video_list_object_attachment
#   Note: depends on output of s3_video_bucket
module "on_prem_daemon_video_list_object_attachment" {
  source = "../modules/attach_policy_to_user"

  policy_user = "${var.env}-daemon-video"
  policy_arn  = var.s3_list_bucket_policy_output
}

module "on_prem_daemon_video_vms" {
  source = "git@github.com:theorchard/terraform-vmware.git//?ref=1.1.1"

  vsphere_user     = var.vsphere_user
  vsphere_password = var.vsphere_password
  vsphere_server   = "ny-vsphere01.theorchard.local"

  vm_hostnames = [
    "prod-daemon-video01",
    "prod-daemon-video02",
  ]

  vm_domain = "theorchard.local"

  vm_num_cpus                  = "2"
  vm_memory                    = "4096"
  vsphere_datacenter_name      = "ny-vsphere-dc"
  vsphere_datastore_name       = "nimble2-vol09"
  vsphere_compute_cluster_name = "ny-vsphere-cluster"
  vsphere_network_name         = "Server Network"
}

resource "aws_iam_user_policy_attachment" "attach_existing_managed_policies_to_on_prem_user" {
  count      = length(local.on_prem_managed_iam_policies)
  user       = "${var.env}-daemon-video"
  policy_arn = local.on_prem_managed_iam_policies[count.index]
}

## Setup datadog dashboards.
module "fargate_service_dashboard" {
  source           = "git@github.com:theorchard/terraform-datadog.git//modules/service?ref=3.0.6"
  environment      = var.env
  environment_type = "fargate"
  service_name     = "ows-video"
}

# Mount monitor
resource "datadog_monitor" "mount_monitor" {
  name               = "${var.env}-daemon-video-mount-monitor"
  type               = "metric alert"
  message            = "Daemon-video mounts are offline. Notify: @slack-monitoring @slack-distro-prod-alarms"
  escalation_message = "Daemon-video mounts are still offline. Notify: @slack-monitoring @slack-distro-prod-alarms"

  query = "avg(last_5m):avg:mount.ripped_assets.available{environment:${var.env},service_name:daemon-video} + avg:mount.rip_assets_video.available{environment:${var.env},service_name:daemon-video} by {host} < 2"

  thresholds = {
    critical = 2
  }

  require_full_window = false
  notify_no_data      = true
  notify_audit        = false
  no_data_timeframe   = 10
  renotify_interval   = 60
  include_tags        = true
  locked              = false
  timeout_h           = 0

  tags = [
    "environment:${var.env}",
    "service_name:daemon-video",
  ]
}