resource "tls_private_key" "efs_bastion" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "efs_bastion" {
  key_name   = "${var.name}-efs-bastion"
  public_key = tls_private_key.efs_bastion.public_key_openssh
}

resource "aws_instance" "efs_bastion" {
  ami = var.ami
  instance_type = var.instance_type
  subnet_id = var.subnet
  associate_public_ip_address = true
  key_name = aws_key_pair.efs_bastion.key_name

  vpc_security_group_ids = concat([ var.efs_security_group ], var.extra_security_groups)

  tags = merge({
    "Name" = "${var.name}-efs-bastion"
  }, var.tags)

  lifecycle {
    create_before_destroy = true
  }

  provisioner "remote-exec" {
    inline = [
      "echo terraform remote-exec setup, install nfs-utils and mount efs from ${var.efs_mount_dns_name}",
      "sudo mkdir -p /mnt/shared-file-system",
      "sudo yum install nfs-utils bc telnet curl git -y",
      # https://docs.aws.amazon.com/efs/latest/ug/gs-step-three-connect-to-ec2-instance.html
      "sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport ${var.efs_mount_dns_name}:/ /mnt/shared-file-system",
      # let main user write to the mount
      "sudo chown ${var.ami_user}:${var.ami_user} /mnt/shared-file-system",
      # create fstab entry to ensure automount on reboots
      # https://docs.aws.amazon.com/efs/latest/ug/mount-fs-auto-mount-onreboot.html#mount-fs-auto-mount-on-creation
      "sudo su -c \"echo '${var.efs_mount_dns_name}:/ /mnt/shared-file-system nfs4 defaults,vers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0' >> /etc/fstab\"" #create fstab entry to ensure automount on reboots
    ]
  }

  connection {
    host        = self.public_ip
    type        = "ssh"
    user        = var.ami_user
    agent       = false
    timeout     = "3m"
    private_key = tls_private_key.efs_bastion.private_key_pem
  }
}