resource "aws_ecs_service" "appetizer_service_staging" {
  name            = "appetizer-staging"
  cluster         = aws_ecs_cluster.demo_cluster.id
  launch_type     = "FARGATE"
  task_definition = aws_ecs_task_definition.appetizer_staging.arn
  desired_count   = 1

  network_configuration {
    subnets = aws_subnet.private.*.id
    security_groups = [
      aws_security_group.allow_self_web.id,
      aws_security_group.egress_all.id,
      // aws_security_group.allow_443_from_anywhere.id
    ]
    assign_public_ip = true
  }

  deployment_circuit_breaker {
    enable   = "true"
    rollback = "false"
  }

  load_balancer {
    target_group_arn = aws_alb_target_group.appetizer_staging.arn
    container_name   = "appetizer"
    container_port   = local.appetizer_port
  }

  propagate_tags          = "SERVICE"
  enable_ecs_managed_tags = true
  tags                    = local.cost_tags

  depends_on = [
    aws_ecs_task_definition.appetizer_staging
  ]
}

resource "aws_ecs_service" "appetizer_service_production" {
  name            = "appetizer-production"
  cluster         = aws_ecs_cluster.demo_cluster.id
  launch_type     = "FARGATE"
  task_definition = aws_ecs_task_definition.appetizer_production.arn
  desired_count   = 1

  network_configuration {
    subnets = aws_subnet.private.*.id
    security_groups = [
      aws_security_group.allow_self_web.id,
      aws_security_group.egress_all.id,
    ]
    assign_public_ip = true
  }

  deployment_circuit_breaker {
    enable   = "true"
    rollback = "true"
  }

  load_balancer {
    target_group_arn = aws_alb_target_group.appetizer.arn
    container_name   = "appetizer"
    container_port   = local.appetizer_port
  }

  propagate_tags          = "SERVICE"
  enable_ecs_managed_tags = true
  tags                    = local.cost_tags

  depends_on = [
    aws_ecs_task_definition.appetizer_production
  ]
}

resource "aws_ecs_task_definition" "appetizer_staging" {
  family                    = "tf_http_appetizer_staging_td"
  container_definitions     = data.template_file.task_definition_appetizer_staging.rendered
  requires_compatibilities  = ["FARGATE"]
  network_mode              = "awsvpc"
  cpu                       = 256
  memory                    = 512
  task_role_arn             = aws_iam_role.appetizer_task_role.arn
  execution_role_arn        = aws_iam_role.appetizer_task_role.arn

  tags                      = local.cost_tags
}

resource "aws_ecs_task_definition" "appetizer_production" {
  family                    = "tf_http_appetizer_production_td"
  container_definitions     = data.template_file.task_definition_appetizer_production.rendered
  requires_compatibilities  = ["FARGATE"]
  network_mode              = "awsvpc"
  cpu                       = 512
  memory                    = 1024
  task_role_arn             = aws_iam_role.appetizer_task_role.arn
  execution_role_arn        = aws_iam_role.appetizer_task_role.arn

  tags                      = local.cost_tags
}

data aws_secretsmanager_secret dockerhub {
  name = "dockerhub"
}

data aws_secretsmanager_secret appetizer_password {
  name = "appetizer_password"
}

data aws_secretsmanager_secret appetizer_mm_identity {
  name = "appetizer_demo_id_mattermost"
}

data template_file "task_definition_appetizer_production" {
  template = file("${path.module}/templates/task-definition-appetizer.json")

  vars = {
    docker_hub_secret_arn = data.aws_secretsmanager_secret.dockerhub.arn
    container_image            = "openziti/appetizer:latest"
    container_name        = "appetizer"
    container_port        = local.appetizer_port
    log_group_region = "us-east-1"
    log_group_name = aws_cloudwatch_log_group.appetizer_logs_production.name
    region    = "us-east-1"

    openziti_user = "clint"
    openziti_pwd_arn = data.aws_secretsmanager_secret.appetizer_password.arn
    openziti_ctrl = "https://db2f5d29-d062-47e1-82dc-a12738f0768e.production.netfoundry.io:443"
    openziti_acme_email = "clint@openziti.org"
    openziti_domain = "appetizer.openziti.io"
    openziti_ca = "prod"
    openziti_mm_url = "http://webhook.mattermost.ziti.com:80/hooks/y1duw5drw3yu8gznjoyb87uzor"
    openziti_mm_identity_arn = data.aws_secretsmanager_secret.appetizer_mm_identity.arn
    is_prod = "y"

  }
}

data template_file "task_definition_appetizer_staging" {
  template = file("${path.module}/templates/task-definition-appetizer-staging.json")
  vars = {
    docker_hub_secret_arn = data.aws_secretsmanager_secret.dockerhub.arn
    container_image            = "openziti/appetizer:latest"
    container_name        = "appetizer"
    container_port        = local.appetizer_port
    log_group_region = "us-east-1"
    log_group_name = aws_cloudwatch_log_group.appetizer_logs_staging.name
    region    = "us-east-1"

    openziti_user = "clint"
    openziti_pwd_arn = data.aws_secretsmanager_secret.appetizer_password.arn
    openziti_ctrl = "https://db2f5d29-d062-47e1-82dc-a12738f0768e.production.netfoundry.io:443"
    openziti_acme_email = "clint@openziti.org"
    openziti_domain = "appetizer-staging.openziti.io"
    openziti_ca = "staging"
    openziti_mm_url = "http://webhook.mattermost.ziti.com:80/hooks/y1duw5drw3yu8gznjoyb87uzor"
    openziti_mm_identity_arn = data.aws_secretsmanager_secret.appetizer_mm_identity.arn
    is_prod = "n"
  }
}

#########################
# Logging
#########################
resource "aws_cloudwatch_log_group" "appetizer_logs_staging" {
  name              = "tf-ecs-group/appetizer-staging"
  retention_in_days = 30
  tags              = local.cost_tags
}

resource "aws_cloudwatch_log_group" "appetizer_logs_production" {
  name              = "tf-ecs-group/appetizer-production"
  retention_in_days = 30
  tags              = local.cost_tags
}