#
# AWS
# website web server.
#

provider "aws" {
    region = "us-west-2"
}

variable "stage" {
}

variable "ami" {
}

variable "instance_type" {
}

variable "key_name" {
}

variable "elb_certificate_arn" {
}

variable "preview_elb_certificate_arn" {
}


locals {
    website_server_name = "${var.stage}-website"  
}


resource "aws_instance" "website" {
    ami = "${var.ami}"
    instance_type = "${var.instance_type}"
    placement_group = "${var.stage}_placement_group"
    key_name = "${var.key_name}"
    security_groups = [
        "${aws_security_group.website_security_group.name}",
        
        # Developer: SSH access security group
        "[Bigscreen] SSH Server Access"
    ]

    tags = {
        Name = "[${var.stage}] ${local.website_server_name}"
    }
}


# Security group for the web server itself.
resource "aws_security_group" "website_security_group" {
    name        = "${local.website_server_name}_security_group"
    description = "${local.website_server_name} Internal"
    vpc_id      = "vpc-6284a71b"

    # ELB forwarding along port 80 for https for the mod panel server.
    ingress {
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        security_groups = ["${aws_security_group.website_elb_security_group.id}"]
    }

    # ELB forwarding along port 80 for the master website security group
    ingress {
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        security_groups = ["sg-0ab3f1573cc84c285"]
    }

    # Allow Jenkins build server to access this server via SSH
    ingress {
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        security_groups = ["sg-0577fa74bb0447c98"]
    }

    # ELB - Team Access
    ingress {
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        security_groups = ["sg-0e0900af538192296"]
    }

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }
    
    tags = {
        Name = "[${var.stage}] ${local.website_server_name}_security_group"
    }
}

#
# website Test Server ELB
#

# Security Group for the website Server ELB
resource "aws_security_group" "website_elb_security_group" {
    name        = "${local.website_server_name}_elb_security_group"
    description = "${local.website_server_name} ELB"
    vpc_id      = "vpc-6284a71b"

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }
    
    tags = {
        Name = "[${var.stage}] ${local.website_server_name}_elb_security_group"
    }
}


# website Server API ELB, sending data 
resource "aws_lb" "website_elb" {
    name               = "${local.website_server_name}-elb"
    internal           = false
    load_balancer_type = "application"
    security_groups = [
        "${aws_security_group.website_elb_security_group.id}",

        # [Bigscreen] General Team Access - allows access via https 
        "sg-0e0900af538192296"
    ]
    subnets            = ["subnet-08218e43", "subnet-9e79f4e7", "subnet-bc5736e6", "subnet-41185f69"]

    enable_deletion_protection = false
}


resource "aws_lb_target_group" "website_target" {
    name     = "${local.website_server_name}-target"
    port     = 80
    protocol = "HTTP"
    vpc_id      = "vpc-6284a71b"
}


resource "aws_lb_target_group_attachment" "test" {
  target_group_arn = "${aws_lb_target_group.website_target.arn}"
  target_id        = "${aws_instance.website.id}"
  port             = 80
}


resource "aws_lb_listener" "website_elb" {
    load_balancer_arn = "${aws_lb.website_elb.arn}"
    port              = "443"
    protocol          = "HTTPS"
    ssl_policy        = "ELBSecurityPolicy-2016-08"
    certificate_arn   = "${var.elb_certificate_arn}"

    default_action {
        type             = "forward"
        target_group_arn = "${aws_lb_target_group.website_target.arn}"
    }
}


# Security Group for the Preview website Server ELB
#
# This allows a preview of the website over a different URL.
resource "aws_security_group" "website_preview_elb_security_group" {
    name        = "${local.website_server_name}_preview_elb_security_group"
    description = "${local.website_server_name} Preview ELB"
    vpc_id      = "vpc-6284a71b"

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }
    
    tags = {
        Name = "[${var.stage}] ${local.website_server_name}_preview_elb_security_group"
    }
}


# Preview website ELB
resource "aws_lb" "website_preview_elb" {
    name               = "${local.website_server_name}-preview-elb"
    internal           = false
    load_balancer_type = "application"
    security_groups = [
        "${aws_security_group.website_preview_elb_security_group.id}",

        # [Bigscreen] General Team Access - allows access via https 
        "sg-0e0900af538192296"
    ]
    subnets            = ["subnet-08218e43", "subnet-9e79f4e7", "subnet-bc5736e6", "subnet-41185f69"]

    enable_deletion_protection = false
}


resource "aws_lb_target_group" "website_preview_target" {
    name     = "${local.website_server_name}-preview"
    port     = 80
    protocol = "HTTP"
    vpc_id      = "vpc-6284a71b"
}


resource "aws_lb_target_group_attachment" "website_preview_attachment" {
  target_group_arn = "${aws_lb_target_group.website_preview_target.arn}"
  target_id        = "${aws_instance.website.id}"
  port             = 80
}


resource "aws_lb_listener" "website_preview_elb" {
    load_balancer_arn = "${aws_lb.website_preview_elb.arn}"
    port              = "443"
    protocol          = "HTTPS"
    ssl_policy        = "ELBSecurityPolicy-2016-08"
    certificate_arn   = "${var.preview_elb_certificate_arn}"

    default_action {
        type             = "forward"
        target_group_arn = "${aws_lb_target_group.website_preview_target.arn}"
    }
}

#
# Outputs - DNS addresses for the server, and the ELBs
#
output "website_dns" {
    value = "${aws_instance.website.public_dns}"
}

output "website_elb_dns" {
    value = "${aws_lb.website_elb.dns_name}"
}

output "website_preview_elb_dns" {
    value = "${aws_lb.website_preview_elb.dns_name}"
}