resource "aws_ecs_service" "service" {
  name            = "ecs-fargate-${local.service_name}"
  cluster         = data.terraform_remote_state.mop_core.outputs.ecs_cluster_id
  launch_type     = "FARGATE"
  task_definition = aws_ecs_task_definition.service_task.arn
  desired_count   = local.task_count
  #iam_role        = var.iam_role

  network_configuration {
    subnets = data.terraform_remote_state.mop_core.outputs.vpc_subnet_private_ids
    security_groups = [
      data.terraform_remote_state.mop_core.outputs.sg_http_public_id,
      data.terraform_remote_state.mop_core.outputs.sg_alb_id
    ]
    assign_public_ip = true
  }

  service_registries {
    registry_arn = aws_service_discovery_service.gatewayv2_service.arn
  }

  deployment_circuit_breaker {
    enable   = "true"
    rollback = "true"
  }

  load_balancer {
    target_group_arn = aws_alb_target_group.newgroup.id
    container_name   = var.service_name
    container_port   = local.container_port
  }

  propagate_tags          = local.propagate_tags
  enable_ecs_managed_tags = local.enable_ecs_managed_tags
  tags                    = local.cost_bucket_tags

  depends_on = [
    aws_alb_listener.front_end,
    aws_ecs_task_definition.service_task
  ]
}

data aws_ecs_task_definition "service_task" {
  task_definition = "tf_${local.service_name}_td"
  depends_on      = [ aws_ecs_task_definition.service_task ]
}

resource "aws_ecs_task_definition" "service_task" {
  family                    = "tf_${local.service_name}_td"
  container_definitions     = data.template_file.task_definition.rendered
  requires_compatibilities  = ["FARGATE"]
  network_mode              = "awsvpc"
  cpu                       = 1024
  memory                    = 2048
  task_role_arn             = aws_iam_role.gatewayv2_task_role.arn
  execution_role_arn        = aws_iam_role.gatewayv2_task_role.arn
  tags                      = local.cost_bucket_tags
}

# Logging
resource "aws_cloudwatch_log_group" "service_log" {
  name              = "tf-ecs-group/${local.service_name}"
  retention_in_days = 30
  tags              = local.cost_bucket_tags
}

resource aws_alb "alb" {
  name            = "ecs-${var.service_name}"
  internal        = "false"
  subnets         = data.terraform_remote_state.mop_core.outputs.vpc_subnet_public_ids
  security_groups = [
          data.terraform_remote_state.mop_core.outputs.sg_http_public_id,
          data.terraform_remote_state.mop_core.outputs.sg_alb_id
      ]

  access_logs {
    bucket  = aws_s3_bucket.alb_log.bucket
    enabled = var.alb_logs_enabled[terraform.workspace]
  }
  tags            = local.cost_bucket_tags

  depends_on = [aws_s3_bucket.alb_log, aws_s3_bucket_policy.alb_log_policy ]

}

resource aws_alb_listener "front_end" {
  load_balancer_arn  = aws_alb.alb.arn
  port               = "443"
  protocol           = "HTTPS"
  ssl_policy         = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn    = data.terraform_remote_state.mop_core.outputs.acm_wildcard_arn

  default_action {
    target_group_arn = aws_alb_target_group.newgroup.arn
    type             = "forward"
  }
}

resource aws_alb_target_group "newgroup" {
  name                  = "ecs-${var.service_name}-tg"
  port                  = local.container_port
  protocol              = "HTTP"
  vpc_id                = data.terraform_remote_state.mop_core.outputs.vpc_id
  deregistration_delay  = 30
  target_type           = "ip"

  health_check {
    matcher             = "200-299"
    path                = "/actuator/health"
    healthy_threshold   = 2
    timeout             = 25
  }
  tags                  = local.cost_bucket_tags
}

data "aws_secretsmanager_secret" "es_micrometer_creds" {
  name = "es_micrometer_creds"
}

data template_file "task_definition" {
  template = file("${path.module}/templates/task-definition.json")

  vars = {
    image_url             = "745435643501.dkr.ecr.us-east-1.amazonaws.com/gateway:${data.aws_ssm_parameter.container_image.value}"
    #image_url             = "netfoundry/api-gateway:${data.aws_ssm_parameter.container_image.value}"
    #docker_hub_secret_arn = data.terraform_remote_state.mop_core.outputs.dockerhub_secret_arn
    container_name        = local.service_name
    container_port        = local.container_port
    log_group_region      = var.region[terraform.workspace]
    log_group_name        = aws_cloudwatch_log_group.service_log.name
    spring_profiles_active = var.spring_config_label_map[terraform.workspace]
    aws_default_region        = var.region[terraform.workspace]
    deploy_env = local.deploy_env_name
    subdomain = local.subdomain
    es_host = data.terraform_remote_state.mop_core.outputs.es_host
    es_micrometer_username = "${data.aws_secretsmanager_secret.es_micrometer_creds.arn}:username::"
    es_micrometer_password = "${data.aws_secretsmanager_secret.es_micrometer_creds.arn}:password::"
    redis_cluster_address = data.terraform_remote_state.mop_core.outputs.redis_address
    redis_failover_address = data.terraform_remote_state.mop_core.outputs.redis_reader_address
    auth0_client_id       = auth0_client.client.client_id
    auth0_client_secret   = auth0_client.client.client_secret

    // make multi-region friendly
    auth0_issuer = "https://netfoundry-${var.auth0_issuer_map[terraform.workspace]}.auth0.com/"
  }
}