terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tls = {
      source  = "hashicorp/tls"
      version = "~> 4.0"
    }
  }
}

provider "aws" {
  region = var.region
}

# --- Variables ---

variable "region" {
  default = "us-east-1"
}

variable "vpc_id" {
  description = "VPC ID to deploy into"
  type        = string
}

variable "subnet_ids" {
  description = "At least 2 subnet IDs in different AZs (required for RDS subnet group)"
  type        = list(string)
}

variable "db_password" {
  description = "Postgres master password"
  type        = string
  sensitive   = true
}

variable "ssh_cidr" {
  description = "CIDR block for SSH access (e.g., 203.0.113.50/32)"
  type        = string
}

variable "ec2_instance_type" {
  default = "c5.xlarge"
}

variable "scanning" {
  description = "Set to true during scanning phase, false for serving-only (tears down EC2, RDS, icons bucket)"
  type        = bool
  default     = true
}

# --- Data sources ---

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-2023*-x86_64"]
  }
  filter {
    name   = "state"
    values = ["available"]
  }
}

# --- SSH Key ---

resource "tls_private_key" "ec2" {
  count     = var.scanning ? 1 : 0
  algorithm = "ED25519"
}

resource "aws_key_pair" "ec2" {
  count      = var.scanning ? 1 : 0
  key_name   = "everytab-key"
  public_key = tls_private_key.ec2[0].public_key_openssh
}

# --- Security Groups ---

resource "aws_security_group" "ec2" {
  count       = var.scanning ? 1 : 0
  name        = "everytab-ec2"
  description = "EveryTab EC2 instance"
  vpc_id      = var.vpc_id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.ssh_cidr]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "rds" {
  count       = var.scanning ? 1 : 0
  name        = "everytab-rds"
  description = "EveryTab RDS instance"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.ec2[0].id]
  }
}

# --- IAM ---

resource "aws_iam_role" "ec2" {
  count = var.scanning ? 1 : 0
  name  = "everytab-ec2-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "s3_access" {
  count = var.scanning ? 1 : 0
  name  = "everytab-s3-access"
  role  = aws_iam_role.ec2[0].id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:HeadObject"]
        Resource = [
          aws_s3_bucket.icons[0].arn,
          "${aws_s3_bucket.icons[0].arn}/*",
          aws_s3_bucket.site.arn,
          "${aws_s3_bucket.site.arn}/*",
        ]
      },
      {
        Effect = "Allow"
        Action = ["s3:GetObject", "s3:ListBucket"]
        Resource = [
          "arn:aws:s3:::commoncrawl",
          "arn:aws:s3:::commoncrawl/*",
        ]
      }
    ]
  })
}

resource "aws_iam_instance_profile" "ec2" {
  count = var.scanning ? 1 : 0
  name  = "everytab-ec2-profile"
  role  = aws_iam_role.ec2[0].name
}

# --- S3 ---

resource "aws_s3_bucket" "icons" {
  count  = var.scanning ? 1 : 0
  bucket = "everytab-icons"
}

resource "aws_s3_bucket_public_access_block" "icons" {
  count                   = var.scanning ? 1 : 0
  bucket                  = aws_s3_bucket.icons[0].id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket" "site" {
  bucket = "everytab-site"
}

# --- RDS ---

resource "aws_db_subnet_group" "main" {
  count      = var.scanning ? 1 : 0
  name       = "everytab"
  subnet_ids = var.subnet_ids
}

resource "aws_db_instance" "main" {
  count                  = var.scanning ? 1 : 0
  identifier             = "everytab"
  engine                 = "postgres"
  engine_version         = "16"
  instance_class         = "db.t3.medium"
  allocated_storage      = 20
  storage_type           = "gp3"
  db_name                = "everytab"
  username               = "everytab"
  password               = var.db_password
  db_subnet_group_name   = aws_db_subnet_group.main[0].name
  vpc_security_group_ids = [aws_security_group.rds[0].id]
  publicly_accessible    = false
  multi_az               = false
  backup_retention_period = 0
  skip_final_snapshot    = true
}

# --- EC2 ---

resource "aws_instance" "main" {
  count                = var.scanning ? 1 : 0
  ami                  = data.aws_ami.al2023.id
  instance_type        = var.ec2_instance_type
  key_name             = aws_key_pair.ec2[0].key_name
  vpc_security_group_ids = [aws_security_group.ec2[0].id]
  subnet_id            = var.subnet_ids[0]
  iam_instance_profile = aws_iam_instance_profile.ec2[0].name

  root_block_device {
    volume_size = 50
    volume_type = "gp3"
  }

  tags = {
    Name = "everytab"
  }
}

# --- Outputs ---

output "ec2_public_ip" {
  value = var.scanning ? aws_instance.main[0].public_ip : null
}

output "rds_endpoint" {
  value = var.scanning ? aws_db_instance.main[0].endpoint : null
}

output "database_url" {
  value     = var.scanning ? "postgres://everytab:${var.db_password}@${aws_db_instance.main[0].endpoint}/everytab" : null
  sensitive = true
}

output "ssh_private_key" {
  value     = var.scanning ? tls_private_key.ec2[0].private_key_openssh : null
  sensitive = true
}

output "ssh_command" {
  value = var.scanning ? "ssh -i everytab-key ec2-user@${aws_instance.main[0].public_ip}" : null
}