# ─── Network ─────────────────────────────────────────────────────────────────
module "network" {
  source      = "../../modules/network"
  project     = var.project
  environment = var.environment
}

# ─── Security Groups ─────────────────────────────────────────────────────────
module "security" {
  source      = "../../modules/security"
  vpc_id      = module.network.vpc_id
  project     = var.project
  environment = var.environment
}

# ─── ECR Repositories ────────────────────────────────────────────────────────
module "ecr" {
  source      = "../../modules/ecr"
  project     = var.project
  environment = var.environment
}

# ─── GitHub Actions OIDC ─────────────────────────────────────────────────────
module "oidc_github" {
  source              = "../../modules/oidc-github"
  project             = var.project
  environment         = var.environment
  github_org          = var.github_org
  github_repo         = var.github_repo
  ecr_arns            = values(module.ecr.repository_arns)
  state_bucket_arn    = data.aws_s3_bucket.terraform_state.arn
  deploy_instance_arn = module.ec2.instance_arn
  # Uploads bucket (created out-of-band) also hosts published helix CLI
  # artifacts under cli-dist/*; grant CI scoped PutObject there so
  # .github/workflows/cli-release.yml can publish.
  cli_dist_bucket_arn = "arn:aws:s3:::helix-prod-uploads-ap-southeast-1"
}

data "aws_s3_bucket" "terraform_state" {
  bucket = "${var.project}-terraform-state-${data.aws_caller_identity.current.account_id}"
}

data "aws_caller_identity" "current" {}

# ─── EC2 Application Host ───────────────────────────────────────────────────
module "ec2" {
  source             = "../../modules/ec2"
  project            = var.project
  environment        = var.environment
  instance_type      = var.ec2_instance_type
  subnet_id          = module.network.private_app_subnet_ids[0]
  security_group_id  = module.security.app_sg_id
  key_name           = var.ec2_key_name
  state_bucket_arn   = data.aws_s3_bucket.terraform_state.arn
  uploads_bucket_arn = "arn:aws:s3:::helix-prod-uploads-ap-southeast-1"
  ecr_arns           = values(module.ecr.repository_arns)
}

# ─── ACM Certificate ────────────────────────────────────────────────────────
resource "aws_acm_certificate" "main" {
  domain_name       = var.domain_name
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }

}

# DNS for pingcap.net is owned by DNSPod, outside this AWS state. This waiter
# records the already-issued ACM certificate without claiming DNS ownership.
resource "aws_acm_certificate_validation" "main" {
  certificate_arn = aws_acm_certificate.main.arn
}

# ─── ALB ─────────────────────────────────────────────────────────────────────
module "alb" {
  source            = "../../modules/alb"
  project           = var.project
  environment       = var.environment
  vpc_id            = module.network.vpc_id
  public_subnet_ids = module.network.public_subnet_ids
  security_group_id = module.security.alb_sg_id
  instance_id       = module.ec2.instance_id
  certificate_arn   = aws_acm_certificate_validation.main.certificate_arn
}

# ─── ElastiCache Redis ───────────────────────────────────────────────────────
module "elasticache" {
  source            = "../../modules/elasticache"
  project           = var.project
  environment       = var.environment
  subnet_ids        = module.network.private_cache_subnet_ids
  security_group_id = module.security.cache_sg_id
  node_type         = var.redis_node_type
}

# ─── SSM Secrets ─────────────────────────────────────────────────────────────
module "ssm_secrets" {
  source      = "../../modules/ssm-secrets"
  project     = var.project
  environment = var.environment
  domain_name = var.domain_name
}