#
# Core Bigscreen API.
#

provider "aws" {
    region = "us-west-2"
}

variable "network_name" {
}

variable "fleet_name" {
}

variable "ami" {
}

variable "instance_type" {
}

variable "key_name" {
}

variable "elb_certificate_arn" {
    type = string
}


locals {
    api_server_name = "${var.network_name}-${var.fleet_name}-api"
    network_fleet_name = "${var.network_name}_${var.fleet_name}"
}


resource "aws_instance" "api" {
    ami = "${var.ami}"
    instance_type = "${var.instance_type}"
    placement_group = "${local.network_fleet_name}_placement_group"
    key_name = "${var.key_name}"
    security_groups = [
        "${aws_security_group.api_security_group.name}",
        
        # Developer: SSH access security group
        "[Bigscreen] SSH Server Access"
    ]

    tags = {
        Name = "[${local.network_fleet_name}] ${local.api_server_name}"
    }

    root_block_device {
        volume_type = "gp2"
        volume_size = "128"
    }

    # nginx config
    provisioner "file" {
        source = "/home/ubuntu/networks/${var.network_name}/${var.fleet_name}/config/${var.network_name}_${var.fleet_name}_api.nginx.conf"
        destination = "/home/ubuntu/${var.network_name}_${var.fleet_name}_api.nginx.conf"
    }

    provisioner "remote-exec" {
        inline = [
            "sudo cp /home/ubuntu/${var.network_name}_${var.fleet_name}_api.nginx.conf /etc/nginx/sites-enabled/default",
            "sudo service nginx restart",
        ]
    }

    connection {
        type = "ssh"
        host = self.public_dns
        user = "ubuntu"
        private_key = file("/home/ubuntu/networks/${var.network_name}/${var.fleet_name}/aws/${var.key_name}.pem")
        timeout = "5m"
    }
}


# Security group for the api server itself.
resource "aws_security_group" "api_security_group" {
    name        = "${local.api_server_name}_security_group"
    description = "${local.api_server_name} Internal"
    vpc_id      = "vpc-6284a71b"

    # ELB forwarding along port 80 for https for the api server.
    ingress {
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        security_groups = ["${aws_security_group.api_elb_security_group.id}"]
    }

    # Jenkins SSH access
    ingress {
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        security_groups = ["sg-0577fa74bb0447c98"]
    }

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }
    
    tags = {
        Name = "[${local.network_fleet_name}] ${local.api_server_name}_security_group"
    }
}


#
# api Server ELB
#

# Security Group for the api Server ELB
resource "aws_security_group" "api_elb_security_group" {
    name        = "${local.api_server_name}_elb_security_group"
    description = "${local.api_server_name} ELB"
    vpc_id      = "vpc-6284a71b"

    ingress {
        from_port   = 443
        to_port     = 443
        protocol    = "tcp"
        # Please restrict your ingress to only necessary IPs and ports.
        # Opening to 0.0.0.0/0 can lead to security vulnerabilities.
        cidr_blocks = ["0.0.0.0/0"] 
    }

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }
    
    tags = {
        Name = "[${local.network_fleet_name}] ${local.api_server_name}_elb_security_group"
    }
}


# api Server API ELB, sending data 
resource "aws_lb" "api_elb" {
    name               = "${local.api_server_name}-elb"
    internal           = false
    load_balancer_type = "application"
    security_groups = ["${aws_security_group.api_elb_security_group.id}"]
    subnets            = ["subnet-08218e43", "subnet-9e79f4e7", "subnet-bc5736e6", "subnet-41185f69"]

    enable_deletion_protection = false
}


resource "aws_lb_target_group" "api-target" {
    name     = "${local.api_server_name}-target"
    port     = 80
    protocol = "HTTP"
    vpc_id      = "vpc-6284a71b"
}


resource "aws_lb_target_group_attachment" "test" {
  target_group_arn = "${aws_lb_target_group.api-target.arn}"
  target_id        = "${aws_instance.api.id}"
  port             = 80
}


resource "aws_lb_listener" "api_elb" {
    load_balancer_arn = "${aws_lb.api_elb.arn}"
    port              = "443"
    protocol          = "HTTPS"
    ssl_policy        = "ELBSecurityPolicy-2016-08"
    certificate_arn   = "${var.elb_certificate_arn}"

    default_action {
        type             = "forward"
        target_group_arn = "${aws_lb_target_group.api-target.arn}"
    }
}

#
# Outputs - DNS addresses for the server, and the ELBs
#
output "api_dns" {
    value = "${aws_instance.api.public_dns}"
}

output "api_elb_dns" {
    value = "${aws_lb.api_elb.dns_name}"
}

output "security_group_id" {
    value = "${aws_security_group.api_security_group.id}"
}