locals {
  cidr_blocks = concat(
  data.terraform_remote_state.mop_core.outputs.vpc_subnets_private_cidr_blocks,
  data.terraform_remote_state.mop_core_failover.outputs.vpc_subnets_private_cidr_blocks,
  formatlist("%s/32", [data.terraform_remote_state.mop_core.outputs.bastion_ip])
  )
}

resource "aws_security_group" "auth_service" {
  name = local.service_name
  description = "Allow access from the traefik LB"
  vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
  tags = {
    Name = local.service_name
  }

  # allowing all traffic from itself
  ingress {
    from_port = 0
    to_port   = 65535
    protocol  = "tcp"
    self      = true
  }

  // @TODO - this might be deprecated and can probably be removed
  ingress {
    from_port = local.grpc_port
    to_port   = local.grpc_port
    protocol  = "tcp"
    cidr_blocks = local.cidr_blocks
  }
  ingress {
    from_port = local.container_port
    to_port   = local.container_port
    protocol  = "tcp"
    cidr_blocks = local.cidr_blocks
  }
  
  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}

resource "aws_security_group" "auth_service_https" {
    name = "${local.service_name}-https"
    description = "HTTPS access to ${local.service_name}"
    vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
    tags = {
        Name = "${local.service_name}-https"
    }

    // allow traffic for TCP 443,18443/tcp from SG (self)
    ingress {
        from_port = 443
        to_port = 443
        protocol = "tcp"
    }
    ingress {
        from_port = 18443
        to_port = 18443
        protocol = "tcp"
    }

    // allow traffic for 443,18443/tcp from authorized IPv4
    ingress {
        from_port = 443
        to_port = 443
        protocol = "tcp"
        cidr_blocks = local.cidr_blocks
    }
    ingress {
        from_port = 18443
        to_port = 18443
        protocol = "tcp"
        cidr_blocks = local.cidr_blocks
    }

    egress {
        from_port       = 0
        to_port         = 0
        protocol        = "-1"
        cidr_blocks     = ["0.0.0.0/0"]
    }

}

resource "aws_security_group" "auth_service_mysql" {
    name = "${local.service_name}-mysql"
    description = "Security Group ${local.service_name}-mysql"
    vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
    tags = {
        Name = "${local.service_name}-mysql"
    }

    // NOTE: I am pretty sure 
    // allows traffic from the SG itself for tcp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    self = true
  }

    // allows traffic from the SG itself for udp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    self = true
  }

  // allows traffic from the legacy SG
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }

  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }


  // allow traffic for TCP 22
  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  // allow traffic for TCP 3306
  ingress {
    from_port = 3306
    to_port = 3306
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}