# TiDB Cloud Dedicated cluster + AWS PrivateLink connection
#
# This module manages:
# 1. TiDB Cloud Dedicated cluster via tidbcloud provider
# 2. TiDB Cloud private endpoint service (AWS PrivateLink)
# 3. AWS-side VPC endpoint for private connectivity
# 4. Route53 private DNS for internal resolution

terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    tidbcloud = {
      source  = "tidbcloud/tidbcloud"
      version = "~> 0.4"
    }
  }

  backend "s3" {
    # Configured via -backend-config or backend.hcl
    # bucket         = "helix-terraform-state-<account-id>"
    # key            = "tidb-cloud/terraform.tfstate"
    # region         = "ap-southeast-1"
    # dynamodb_table = "helix-terraform-lock"
    # encrypt        = true
  }
}

provider "aws" {
  region = var.region
}

provider "tidbcloud" {
  # Credentials via environment variables:
  # TIDBCLOUD_PUBLIC_KEY and TIDBCLOUD_PRIVATE_KEY
}

data "aws_caller_identity" "current" {}

# ─── TiDB Cloud Dedicated Cluster ───────────────────────────────────────────

resource "tidbcloud_cluster" "helix" {
  project_id   = var.tidb_project_id
  name         = "${var.project}-${var.environment}"
  cluster_type = "DEDICATED"

  cloud_provider = "AWS"
  region         = var.tidb_region

  config {
    root_password = var.tidb_root_password

    component {
      tidb {
        node_size     = var.tidb_node_size
        node_quantity = var.tidb_node_quantity
      }
      tikv {
        node_size        = var.tikv_node_size
        node_quantity    = var.tikv_node_quantity
        storage_size_gib = var.tikv_storage_size_gib
      }
    }
  }
}

# ─── TiDB Cloud Private Endpoint Service ────────────────────────────────────
# Creates the PrivateLink endpoint service on TiDB Cloud side,
# then creates the AWS VPC endpoint to connect to it.

resource "tidbcloud_private_endpoint" "aws" {
  project_id   = var.tidb_project_id
  cluster_id   = tidbcloud_cluster.helix.id
  display_name = "${var.project}-${var.environment}-privatelink"
}

# ─── AWS VPC Endpoint for TiDB Cloud PrivateLink ────────────────────────────

resource "aws_vpc_endpoint" "tidb" {
  vpc_id             = var.vpc_id
  service_name       = tidbcloud_private_endpoint.aws.private_link_service_name
  vpc_endpoint_type  = "Interface"
  subnet_ids         = var.private_subnet_ids
  security_group_ids = [var.db_security_group_id]

  private_dns_enabled = false

  tags = {
    Name        = "${var.project}-${var.environment}-tidb-endpoint"
    Project     = var.project
    Environment = var.environment
  }
}

# ─── Accept the Private Endpoint connection on TiDB Cloud side ──────────────

resource "tidbcloud_private_endpoint_connection" "aws" {
  project_id          = var.tidb_project_id
  cluster_id          = tidbcloud_cluster.helix.id
  private_endpoint_id = tidbcloud_private_endpoint.aws.id
  endpoint_id         = aws_vpc_endpoint.tidb.id
  aws_account_id      = data.aws_caller_identity.current.account_id
}

# ─── Route53 private hosted zone for TiDB endpoint DNS ──────────────────────

resource "aws_route53_zone" "tidb_private" {
  name = "tidb.${var.environment}.internal"

  vpc {
    vpc_id = var.vpc_id
  }

  tags = {
    Project     = var.project
    Environment = var.environment
  }
}

resource "aws_route53_record" "tidb" {
  zone_id = aws_route53_zone.tidb_private.zone_id
  name    = "db.tidb.${var.environment}.internal"
  type    = "CNAME"
  ttl     = 300
  records = [aws_vpc_endpoint.tidb.dns_entry[0]["dns_name"]]
}