resource "aws_security_group" "zrok_billing_web_traffic" {
  name = "zrok-billing-web-traffic"
  description = "Web traffic ingress and egress rules"
  vpc_id = data.terraform_remote_state.zrok-core.outputs.vpc_id
  tags = {
    Name = "zrok-billing-web-traffic"
  }

  // allow traffic for TCP 443,18443/tcp from SG (self)
  ingress {
    from_port = 443
    to_port = 443
    protocol = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  // allow traffic for 80 - @TODO - to be removed post development phase
  ingress {
    from_port = 80
    to_port = 80
    protocol = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }
}

resource aws_security_group zrok_billing_db_sg {
  name = "zrok-billing-postgres-${local.environment}"
  description = "zrok billing postgres ${local.environment}"
  vpc_id = data.terraform_remote_state.zrok-core.outputs.vpc_id
  tags = {
    Name = "zrok-billing-postgres-${local.environment}"
  }

  // allows traffic from the SG itself for tcp
  ingress {
    from_port = 5432
    to_port = 5432
    protocol = "tcp"
    self = true
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }
}