terraform {
  required_version = "~> 1.2.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.63.0"
    }
  }
}

provider "aws" {
  region     = var.aws_region
  access_key = var.aws_access_key
  secret_key = var.aws_secret_key
}

resource "aws_security_group" "web-sg" {
  name   = "${var.name}-web-sg"
  vpc_id = var.vpc

  // To Allow SSH Transport
  ingress {
    from_port = 22
    protocol = "tcp"
    to_port = 22
    cidr_blocks = ["0.0.0.0/0"]
  }

  // Allow HTTP
  ingress {
    from_port = 80
    protocol = "tcp"
    to_port = 80
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}

resource "tls_private_key" "web-efs-demo-web" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "web-efs-demo-web" {
  key_name   = "${var.name}-web-key"
  public_key = tls_private_key.web-efs-demo-web.public_key_openssh
}

resource "aws_launch_template" "web_launch_template" {
  name          = "${var.name}-web"
  image_id      = var.ami
  instance_type = var.instance_type
  key_name      = aws_key_pair.web-efs-demo-web.key_name

  ebs_optimized = true
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs { volume_size = 20 }
  }

  user_data = base64encode(
    templatefile(
      "${path.module}/init-web-node.sh.tf.template", {
        efs_mount_target_dns_name = var.efs_dns
        content_path              = "active"
      }))

  tag_specifications {
    resource_type = "instance"
    tags = merge({
      Name = "web-${var.name}"
    }, var.tags)
  }

  network_interfaces {
    # needed to install nfsutils (only); use a different AMI with nfsutils installed and omit,
    # and/or Amazon Linux (but mount script may need to change)
    associate_public_ip_address = true

    security_groups = concat([ aws_security_group.web-sg.id ], var.extra_security_groups)
  }
}

resource "aws_autoscaling_group" "web_cluster" {
  name                = "${var.name}-asg"
  vpc_zone_identifier = var.subnets

  desired_capacity   = 3
  max_size           = 3
  min_size           = 1
  health_check_grace_period = 60

  launch_template {
    id      = aws_launch_template.web_launch_template.id
    version = aws_launch_template.web_launch_template.latest_version
  }

  target_group_arns = [
    module.alb.target_group_arn
  ]

  instance_refresh {
    strategy = "Rolling"
    preferences {
      min_healthy_percentage = 50
    }
  }
}

module "alb" {
  source = "./modules/alb"

  name                       = var.name
  vpc_id                     = var.vpc
  deletion_protection        = false
  web_acl_enabled            = false
  access_logs_s3_bucket_name = var.alb_access_logs_s3_bucket_name
  acm_certificate_arn        = var.alb_acm_certificate_arn
  sns_normal                 = null
  sns_urgent                 = null
  tags                       = var.tags
  subnets                    = var.subnets
}

output "alb_dns_name" {
  value = module.alb.alb_dns_name
}

output "web-private-key" {
  value     = tls_private_key.web-efs-demo-web.private_key_pem
  sensitive = true
}