provider "postgresql" {
	scheme = "awspostgres"
	host = data.aws_db_instance.psql.address
	port = data.aws_db_instance.psql.port
	database = data.aws_db_instance.psql.db_name # Connect to existing DB.
	username = data.aws_db_instance.psql.master_username
	password = random_password.psql-master-password.result
	sslmode = "require"
	superuser = false
}

resource "postgresql_role" "md5minmax" {
	name = "md5minmax"
	login = true
	password = random_password.md5minmax.result
}

resource "postgresql_database" "md5minmax" {
	name = "md5minmax"
	owner = postgresql_role.md5minmax.name
}

resource "random_password" "md5minmax" {
	length = 16
	special = false
}

# ==========
# Container tasks:
# ==========

module "bs-task-1" {
	source = "git::https://gitlab.com/sea/public/tf-modules/aws/ecs-container-task.git"
	name = "bs-1"
	image-path = "registry.gitlab.com/sea/public/md5-extremes-search:latest"
	desired-replica-count = 2
	cpu = 256 # 0.25 vCPU, minimum valid amount
	environment-json = <<-EOF
[
  {"name": "PSQL_CONNECTION_STRING", "value": "user=md5minmax host=${data.aws_db_instance.psql.address} password=${random_password.md5minmax.result} dbname=md5minmax sslmode=require"}
]
EOF
	memory = 512 # 0.5 GB, minimum valid amount
	subnets = module.dualstack-vpc-a.ipv6only-subnets-as-list
	assign-public-ip = false # How does this interact with the subnet being public ipv6-only? Hm.
	ecs-cluster = module.central-ecs-cluster.arn
	security-groups = [module.dualstack-vpc-a.default-security-group]
}

module "oidc-blog" {
	source = "./oidc-connection"
	name = "blog"
	branch_ref = "sea/public/blog:ref_type:branch:ref:main"
	state_key = "blog.tf.state"
	openid_connect_provider_arn = aws_iam_openid_connect_provider.gitlab.arn
	extra_permissions = [{
		Effect = "Allow"
		Action = ["*"]
		# Also includes dev blog, and any objects within either.
		Resource = [
			"arn:aws:s3:::*www.frostzero.ca",
			"arn:aws:s3:::*www.frostzero.ca/*"
		]},
		# Certificates (screw it, just do whatever, I'll tighten it later)
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:acm:*"]
		},
		# Cloudfront: (ToDo: Tighten this)
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:cloudfront:*"]
		},
		# Route 53: (ToDo: Tighten this)
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:route53:::hostedzone/*", "arn:aws:route53:::change/*"]
		}
	]
}

# Personal nextcloud instance - bindings from AWS to GitLab 
module "oidc-nextcloud" {
	source = "./oidc-connection"
	name = "nextcloud"
	branch_ref = "sea/public/infrastructure/nextcloud:ref_type:branch:ref:main"
	state_key = "nextcloud.tf.state"
	openid_connect_provider_arn = aws_iam_openid_connect_provider.gitlab.arn
	extra_permissions = [
		# EC2 (ToDo: Tighten this up)
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:ec2:*"]
		},
		# Route 53: (ToDo: Tighten this.)
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:route53:::hostedzone/*", "arn:aws:route53:::change/*"]
		}
	]
}

# AKA blood tablets
module "oidc-vampire-tablets" {
	source = "./oidc-connection"
	name = "vampire-tablets"
	branch_ref = "sea/public/infrastructure/blood-tablets:ref_type:branch:ref:main"
	state_key = "vampire-tablets.tf.state"
	openid_connect_provider_arn = aws_iam_openid_connect_provider.gitlab.arn
	extra_permissions = [
		# Lambda - for setting up the lambda functions
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:lambda:*"]
		},
		# DynamoDB - for creating the tables
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:dynamodb:*"]
		},
		# IAM stuff - for creating roles for lambdas
		{
			Effect = "Allow"
			Action = ["*"]
			Resource = ["arn:aws:iam::*"]
		}
	]
	
}

output "oidc" {
	value = {
		"blog" = module.oidc-blog.o
		"nextcloud" = module.oidc-nextcloud.o
	}
}

# ========================================
# TF STATE BUCKET 
# ========================================

resource "aws_s3_bucket" "tf-state" {
	bucket = "tf-state.frostzero.ca"
	lifecycle {
		prevent_destroy = true
	}
	tags = {
		project = "tf-state"
	}
}

# ========================================
# BUCKET FOR STORING CVs
# ========================================

resource "aws_s3_bucket" "cv-bucket" {
	bucket = "frostzero-cv-pdfs"

	lifecycle {
		prevent_destroy = true
	}
	tags = {
		project = "cv/resume"
	}
}

resource "aws_s3_bucket_public_access_block" "cv-bucket" {
	bucket = aws_s3_bucket.cv-bucket.id
	block_public_acls = false
	block_public_policy = false
	ignore_public_acls = false
	restrict_public_buckets = false
}

resource "aws_s3_bucket_policy" "cv-bucket-public" {
	bucket = aws_s3_bucket.cv-bucket.id
	policy = jsonencode({
		Version = "2012-10-17"
		Statement = [
			{
				Effect = "Allow"
				Principal = "*"
				Action = "s3:GetObject"
				Resource = "${aws_s3_bucket.cv-bucket.arn}/*"
			}
		]
	})
}

# ==========
# AND ASSOCIATED USER FOR UPLOADING VIA GITLAB PIPELINE
# TODO: Replace with granting pipeline permission directly
# ==========

resource "aws_iam_user" "cv-bucket-user" {
	name = "frostzero-cv-pdfs-writer"
	path = "/"
}

resource "aws_iam_access_key" "cv-bucket-user-key" {
	user = aws_iam_user.cv-bucket-user.id
}

resource "aws_iam_user_policy" "cv-bucket-put-policy" {
	user = aws_iam_user.cv-bucket-user.id
	name        = "S3UploadPolicy"

	policy = jsonencode({
		Version = "2012-10-17"
		Statement = [
			{
				Effect = "Allow",
				Action = "s3:PutObject",
				Resource = "${aws_s3_bucket.cv-bucket.arn}/*",
			}
		]
	})
}

output "cv-bucket-user-credentials" {
	sensitive = true
	value = {
		access-key = aws_iam_access_key.cv-bucket-user-key.id
		secret-key = aws_iam_access_key.cv-bucket-user-key.secret
		bucket = aws_s3_bucket.cv-bucket.id
	}
}

output "cv-url" {
	value = "https://${aws_s3_bucket.cv-bucket.id}.s3.ca-central-1.amazonaws.com/oskar-lidelson.pdf"
}

# ========================================
# COLD BACKUPS
# ========================================

resource "aws_s3_bucket" "cold-backups" {
	bucket = "frostzero-cold-backups"
	lifecycle {
		prevent_destroy = true		
	}
	tags = {
		project = "cold-backups"
	}
}

resource "aws_s3_bucket_lifecycle_configuration" "cold-backups-glacier-migration" {
	bucket = aws_s3_bucket.cold-backups.id

	transition_default_minimum_object_size = "varies_by_storage_class"   # optional – allows <128 KiB objects

	rule {
		id = "MovetoGlacier"
		status = "Enabled"

		filter {} # Apply to all objects

		transition {
			days = 0
			storage_class = "GLACIER"
		}
	}
}