module "rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "3.4.1"

  identifier = "jsm-rds"

  engine            = "mysql"
  engine_version    = "5.7.34"
  instance_class    = "db.t3.xlarge"
  allocated_storage = 500

  name     = var.db_config.name
  username = var.db_config.user
  password = var.db_config.password
  port     = var.db_config.port

  iam_database_authentication_enabled = true

  vpc_security_group_ids = ["${module.vpc.default_security_group_id}", "${aws_security_group.allow_apps.id}"]
  multi_az               = "true"

  maintenance_window      = "Mon:00:00-Mon:03:00"
  backup_window           = "03:00-06:00"
  backup_retention_period = "35"

  # Enhanced Monitoring - see example for details on how to create the role
  # by yourself, in case you don't want to create it automatically
  # monitoring_interval = "30"
  monitoring_role_name   = "MyRDSMonitoringRole"
  create_monitoring_role = true

  tags = {
    owner   = "liuy@pingcap.com"
    context = "jsm-customer-service-app"
  }

  # DB subnet group
  subnet_ids = module.vpc.private_subnets

  # DB parameter group
  family = "mysql5.7"

  # DB option group
  create_db_option_group = "false"
  major_engine_version   = "5.7"

  # Snapshot name upon DB deletion
  final_snapshot_identifier = "jsm"

  # Database Deletion Protection
  deletion_protection = true

  parameters = [
    {
      name  = "character_set_client"
      value = "utf8mb4"
    },
    {
      name  = "character_set_server"
      value = "utf8mb4"
    },
    {
      name  = "collation_connection"
      value = "utf8mb4_bin"
    },
    {
      name  = "collation_server"
      value = "utf8mb4_bin"
    }
  ]
}

module "confluence-rds" {
  source  = "terraform-aws-modules/rds/aws"
  version = "3.4.1"

  identifier = "confluence-rds"

  engine            = "mysql"
  engine_version    = "5.7.34"
  instance_class    = "db.t3.small"
  allocated_storage = 40

  name     = var.confluence_db_config.name
  username = var.confluence_db_config.user
  password = var.confluence_db_config.password
  port     = var.confluence_db_config.port

  iam_database_authentication_enabled = true

  vpc_security_group_ids = ["${module.vpc.default_security_group_id}", "${aws_security_group.allow_apps.id}"]
  multi_az               = "true"

  maintenance_window      = "Mon:00:00-Mon:03:00"
  backup_window           = "03:00-06:00"
  backup_retention_period = "35"

  # Enhanced Monitoring - see example for details on how to create the role
  # by yourself, in case you don't want to create it automatically
  # monitoring_interval = "30"
  monitoring_role_name   = "MyRDSMonitoringRole"
  create_monitoring_role = false

  tags = {
    owner   = "liuy@pingcap.com"
    context = "jsm-customer-service-app"
  }

  # DB subnet group
  subnet_ids = module.vpc.private_subnets

  # DB parameter group
  family = "mysql5.7"

  # DB option group
  create_db_option_group = "false"
  major_engine_version   = "5.7"

  # Snapshot name upon DB deletion
  final_snapshot_identifier = "confluence"

  # Database Deletion Protection
  deletion_protection = true

  parameters = [
    {
      name  = "character_set_client"
      value = "utf8mb4"
    },
    {
      name  = "character_set_server"
      value = "utf8mb4"
    },
    {
      name  = "collation_connection"
      value = "utf8mb4_bin"
    },
    {
      name  = "collation_server"
      value = "utf8mb4_bin"
    },
    {
      name  = "log_bin_trust_function_creators"
      value = 1
    },
    {
      name  = "tx_isolation"
      value = "READ-COMMITTED"
    },
    {
      name  = "max_allowed_packet"
      value = 1073741824
    },
    {
      name         = "innodb_log_file_size"
      value        = 268435456
      apply_method = "pending-reboot"
    }
  ]
}

resource "aws_security_group" "allow_apps" {
  name        = "allow_apps"
  description = "Allow apps inbound traffic"
  vpc_id      = module.vpc.vpc_id


  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["${var.vpc_cidr}"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}