provider "google" {
  project = var.project_id
}

# Reserve a static IP address for the VM
resource "google_compute_address" "prometheus_scraper_ip" {
  name         = "prometheus-scraper-${var.app_id}-ip"
  address_type = "EXTERNAL"
  region       = var.region
}

# Create GCS bucket for storing Prometheus data
resource "google_storage_bucket" "prometheus_data_bucket" {
  name     = "${var.project_id}-prometheus-data-${var.app_id}"
  location = var.region

  uniform_bucket_level_access = true
}

# Create service account for the VM
resource "google_service_account" "prometheus_scraper_sa" {
  account_id   = "${var.app_id}-sa"
  display_name = "Prometheus Scraper Service Account for ${var.app_id}"
  description  = "Service account for VM that scrapes Prometheus and stores data in GCS"
}

# Grant the service account permissions to write to the GCS bucket
resource "google_storage_bucket_iam_member" "prometheus_scraper_bucket_writer" {
  bucket = google_storage_bucket.prometheus_data_bucket.name
  role   = "roles/storage.objectCreator"
  member = "serviceAccount:${google_service_account.prometheus_scraper_sa.email}"
}

# Create the GCE VM instance
resource "google_compute_instance" "prometheus_scraper" {
  name         = "prometheus-scraper-${var.app_id}"
  machine_type = var.vm_machine_type
  zone         = var.zone

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
      size  = 10
      type  = "pd-standard"
    }
  }

  network_interface {
    network = "default"
    access_config {
      nat_ip = google_compute_address.prometheus_scraper_ip.address
    }
  }

  service_account {
    email  = google_service_account.prometheus_scraper_sa.email
    scopes = ["cloud-platform"]
  }

  # Allow the VM to be stopped/started
  allow_stopping_for_update = true
}

# Cloud Scheduler job to start the VM daily
resource "google_cloud_scheduler_job" "start_vm" {
  name        = "start-prometheus-scraper-${var.app_id}"
  description = "Start Prometheus scraper VM daily"
  schedule    = var.vm_startup_schedule
  time_zone   = "UTC"
  region      = var.region

  http_target {
    http_method = "POST"
    uri         = "https://compute.googleapis.com/compute/v1/projects/${var.project_id}/zones/${var.zone}/instances/${google_compute_instance.prometheus_scraper.name}/start"
    
    oidc_token {
      service_account_email = google_service_account.scheduler_sa.email
    }
  }

  depends_on = [
    google_project_iam_member.scheduler_permissions,
    google_project_service.cloudscheduler_api
  ]
}

# Cloud Scheduler job to stop the VM after specified delay
# Note: This assumes the VM starts at midnight (00:00). Adjust the schedule accordingly.
# For example, if start is at 00:00 and delay is 2 hours, stop at 02:00
resource "google_cloud_scheduler_job" "stop_vm" {
  name        = "stop-prometheus-scraper-${var.app_id}"
  description = "Stop Prometheus scraper VM ${var.vm_shutdown_delay_hours} hours after startup"
  # Calculate cron schedule: if start is at 00:00 and delay is 2 hours, stop at 02:00
  schedule    = "0 ${var.vm_shutdown_delay_hours} * * *"
  time_zone   = "UTC"
  region      = var.region

  http_target {
    http_method = "POST"
    uri         = "https://compute.googleapis.com/compute/v1/projects/${var.project_id}/zones/${var.zone}/instances/${google_compute_instance.prometheus_scraper.name}/stop"
    
    oidc_token {
      service_account_email = google_service_account.scheduler_sa.email
    }
  }

  depends_on = [
    google_project_iam_member.scheduler_permissions,
    google_project_service.cloudscheduler_api
  ]
}

# Service account for Cloud Scheduler to manage VM lifecycle
resource "google_service_account" "scheduler_sa" {
  account_id   = "${var.app_id}-sched-sa"
  display_name = "Cloud Scheduler Service Account for Prometheus Scraper VM management"
  description  = "Service account used by Cloud Scheduler to start/stop the Prometheus scraper VM"
}

# Grant Cloud Scheduler service account permissions to start/stop the VM
resource "google_project_iam_member" "scheduler_permissions" {
  project = var.project_id
  role    = "roles/compute.instanceAdmin"
  member  = "serviceAccount:${google_service_account.scheduler_sa.email}"
}

# Enable required APIs
resource "google_project_service" "compute_api" {
  project = var.project_id
  service = "compute.googleapis.com"
  
  disable_on_destroy = false
}

resource "google_project_service" "cloudscheduler_api" {
  project = var.project_id
  service = "cloudscheduler.googleapis.com"
  
  disable_on_destroy = false
}