AWSTemplateFormatVersion: '2010-09-09'
Description: O11y ingress

Parameters:
  Env:
    Type: String
  Region:
    Type: String
  ClusterName:
    Type: String
  RsDomainName:
    Type: String
  DsDomainName:
    Type: String
  HostedZoneId:
    Type: String
  UsePCA:
    Type: String
    Default: "false"
    AllowedValues:
      - "true"
      - "false"
    Description: Whether to use Private Certificate Authority (PCA)
  PCAArn:
    Type: String
    Default: ""
    Description: ARN of the Private Certificate Authority (required if UsePCA is true)
  ResourceOwnerTag:
    Type: String
    Description: Tag value for the resource owner

Conditions:
  UsePCACondition: !Equals [!Ref UsePCA, "true"]
  UseACMCondition: !Equals [!Ref UsePCA, "false"]

Resources:
  RsCertificate:
    Condition: UseACMCondition
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref RsDomainName
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Ref RsDomainName
          HostedZoneId: !Ref HostedZoneId
      Tags:
        - Key: Environment
          Value: !Ref Env
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  DsCertificate:
    Condition: UseACMCondition
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DsDomainName
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Ref DsDomainName
          HostedZoneId: !Ref HostedZoneId
      Tags:
        - Key: Environment
          Value: !Ref Env
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  RsPCACertificate:
    Condition: UsePCACondition
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref RsDomainName
      CertificateAuthorityArn: !Ref PCAArn
      Tags:
        - Key: Environment
          Value: !Ref Env

  DsPCACertificate:
    Condition: UsePCACondition
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DsDomainName
      CertificateAuthorityArn: !Ref PCAArn
      Tags:
        - Key: Environment
          Value: !Ref Env
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  RsIpSet:
    Type: AWS::WAFv2::IPSet
    Properties:
      Name: !Sub '${ClusterName}-rs-office'
      Description: Office IP set
      Scope: REGIONAL
      IPAddressVersion: IPV4
      Addresses:
        - 104.196.246.224/32
        - 44.234.235.72/32
        - 120.92.20.16/32
        - 54.81.145.46/32
        - 117.50.66.239/32
        - 45.251.23.184/29
        - 39.170.92.156/32
        - 44.232.56.92/32
        - 18.207.70.160/32
        - 120.92.20.26/32
        - 106.75.116.22/32
        - 54.185.150.209/32
        - 125.238.198.74/32
        - 103.85.175.128/29
        - 106.75.54.70/32
        - 54.148.240.60/32
        - 54.144.61.155/32
        - 180.167.192.138/32
        - 119.28.181.184/32
        - 119.28.138.220/32
        - 54.87.103.202/32
        - 106.75.21.237/32
        - 54.160.183.243/32
        - 173.248.249.128/27
        - 120.92.20.132/32
        - 54.156.132.78/32
        - 120.92.55.116/32
        - 54.156.147.26/32
        - 35.233.250.206/32
        - 119.28.189.132/32
        - 118.113.15.98/32
        - 45.251.23.189/32
        - 128.1.49.85/32
        - 107.22.53.149/32
        - 128.1.49.135/32
        - 211.95.24.8/29
        - 119.136.31.176/32
        - 34.237.193.137/32
        - 117.50.84.111/32
        - 35.170.28.53/32
        - 52.13.110.238/32
        - 45.64.247.112/32
        - 45.64.247.96/32
        - 152.104.28.129/32
        - 54.71.2.116/32
        - 58.94.102.181/32
        - 120.92.100.187/32
        - 54.166.186.135/32
        - 1.203.96.0/29
        - 106.75.104.17/32
        - 211.95.24.10/32
        - 106.75.96.68/32
        - 20.63.218.57/32
        - 35.155.73.60/32
        - 152.32.135.177/32
        - 45.251.23.186/32
        - 34.196.134.104/32
        - 52.41.43.61/32
        - 118.194.230.143/32
        - 101.207.139.187/32
        - 40.74.68.232/32
        - 52.53.225.210/32
        - 117.134.13.184/29
        - 45.64.247.96/27
        - 34.193.173.209/32
        - 106.75.52.157/32
        - 118.194.230.2/32
        - 54.91.191.4/32
        - 120.92.122.221/32
        - 120.92.102.252/32
        - 106.75.97.89/32
        - 183.129.144.200/29
        - 203.90.236.192/27
        - 106.75.64.135/32
        - 183.6.107.178/32
        - 34.208.168.149/32
        - 203.90.236.205/32
        - 34.193.189.203/32
        - 128.1.48.244/32
        - 35.83.225.251/32
        - 35.85.207.121/32
        - 52.11.60.187/32
        - 128.1.40.139/32
        - 104.250.53.216/32
        - 120.92.20.69/32
        - 124.155.208.205/32
        - 104.250.53.237/32
        - 152.32.204.171/32
        - 63.70.5.80/32
      Tags:
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  OfficeIpSet:
    Type: AWS::WAFv2::IPSet
    Properties:
      Name: !Sub '${ClusterName}-ds-office'
      Description: Office IP set
      Scope: REGIONAL
      IPAddressVersion: IPV4
      Addresses:
        - 104.196.246.224/32
        - 120.92.20.16/32
        - 117.50.66.239/32
        - 45.251.23.184/29
        - 106.75.116.22/32
        - 54.185.150.209/32
        - 54.203.54.239/32
        - 103.85.175.128/29
        - 3.71.167.176/32
        - 106.75.54.70/32
        - 54.148.240.60/32
        - 54.144.61.155/32
        - 180.167.192.138/32
        - 119.28.181.184/32
        - 44.231.162.131/32
        - 119.28.138.220/32
        - 106.75.21.237/32
        - 129.226.181.138/32
        - 222.212.99.41/32
        - 120.92.20.132/32
        - 120.92.55.116/32
        - 119.28.189.132/32
        - 45.251.23.189/32
        - 35.85.207.121/32
        - 128.1.49.85/32
        - 34.237.193.137/32
        - 54.250.172.151/32
        - 117.50.84.111/32
        - 13.56.192.33/32
        - 54.71.2.116/32
        - 106.75.104.17/32
        - 34.208.189.148/32
        - 106.75.96.68/32
        - 18.232.214.42/32
        - 152.32.135.177/32
        - 54.188.27.23/32
        - 118.194.230.143/32
        - 101.207.139.187/32
        - 104.250.50.40/32
        - 52.53.225.210/32
        - 117.134.13.184/29
        - 34.193.173.209/32
        - 106.75.52.157/32
        - 54.148.161.241/32
        - 120.92.102.252/32
        - 203.90.236.192/27
        - 106.75.64.135/32
        - 183.6.107.178/32
        - 34.208.168.149/32
        - 63.70.2.110/32
        - 44.234.235.72/32
        - 120.92.55.209/32
        - 39.170.92.156/32
        - 44.232.56.92/32
        - 120.92.20.26/32
        - 13.214.108.29/32
        - 125.238.198.74/32
        - 44.236.31.184/32
        - 100.20.198.224/32
        - 35.83.225.251/32
        - 54.87.103.202/32
        - 52.79.124.61/32
        - 34.209.53.107/32
        - 119.28.24.16/32
        - 173.248.249.128/27
        - 54.156.132.78/32
        - 35.233.250.206/32
        - 118.113.15.98/32
        - 128.1.49.135/32
        - 211.95.24.8/29
        - 119.136.31.176/32
        - 54.160.88.7/32
        - 52.13.110.238/32
        - 43.154.73.240/32
        - 45.64.247.112/32
        - 45.64.247.96/32
        - 152.104.28.129/32
        - 58.94.102.181/32
        - 120.92.100.187/32
        - 1.203.96.0/29
        - 104.250.50.243/32
        - 44.239.25.171/32
        - 211.95.24.10/32
        - 20.63.218.57/32
        - 35.155.73.60/32
        - 45.251.23.186/32
        - 34.196.134.104/32
        - 35.86.46.244/32
        - 52.11.60.187/32
        - 52.41.43.61/32
        - 120.92.72.28/32
        - 40.74.68.232/32
        - 18.204.147.39/32
        - 45.64.247.96/27
        - 118.194.230.2/32
        - 52.72.84.40/32
        - 52.38.19.119/32
        - 165.154.134.148/32
        - 43.155.60.35/32
        - 120.92.122.221/32
        - 106.75.97.89/32
        - 183.129.144.200/29
        - 203.90.236.205/32
        - 128.1.48.244/32
        - 183.129.144.202/32
        - 104.250.53.216/32
        - 120.92.20.69/32
        - 124.155.208.205/32
        - 104.250.53.237/32
        - 152.32.204.171/32
        - 63.70.5.80/32
      Tags:
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  RsWebAcl:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${ClusterName}-rs-api'
      Description: O11Y Regional Server API Web ACL.
      Scope: REGIONAL
      DefaultAction:
        Block: {}
      Rules:
        - Name: regional-server-api
          Priority: 2
          Action:
            Allow: {}
          Statement:
            AndStatement:
              Statements:
                - ByteMatchStatement:
                    FieldToMatch:
                      UriPath: {}
                    PositionalConstraint: STARTS_WITH
                    SearchString: /
                    TextTransformations:
                      - Priority: 0
                        Type: NONE
                - IPSetReferenceStatement:
                    Arn: !GetAtt RsIpSet.Arn
          VisibilityConfig:
            MetricName: o11y-regional-server-api
            CloudWatchMetricsEnabled: true
            SampledRequestsEnabled: true
      VisibilityConfig:
        MetricName: o11y-regional-server-api
        CloudWatchMetricsEnabled: true
        SampledRequestsEnabled: true
      Tags:
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

  DsWebAcl:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${ClusterName}-ds-api'
      Description: O11Y Web ACL.
      Scope: REGIONAL
      DefaultAction:
        Block: {}
      Rules:
        - Name: external
          Priority: 0
          Action:
            Allow: {}
          Statement:
            ByteMatchStatement:
              FieldToMatch:
                UriPath: {}
              PositionalConstraint: STARTS_WITH
              SearchString: /external/
              TextTransformations:
                - Priority: 0
                  Type: NONE
          VisibilityConfig:
            MetricName: o11y-prometheus-api-external
            CloudWatchMetricsEnabled: true
            SampledRequestsEnabled: true
        - Name: internal
          Priority: 5
          Action:
            Allow: {}
          Statement:
            IPSetReferenceStatement:
              Arn: !GetAtt OfficeIpSet.Arn
          VisibilityConfig:
            MetricName: o11y-api-internal
            CloudWatchMetricsEnabled: true
            SampledRequestsEnabled: true
      VisibilityConfig:
        MetricName: o11y-prometheus-api
        CloudWatchMetricsEnabled: true
        SampledRequestsEnabled: true
      Tags:
        - Key: tidbcloud-auto-deploy-owner
          Value: !Ref ResourceOwnerTag

Outputs:
  RsCertificateArn:
    Description: Rs ARN of the created certificate
    Value: !If [UsePCACondition, !Ref RsPCACertificate, !Ref RsCertificate]
  DsCertificateArn:
    Description: Ds ARN of the created certificate
    Value: !If [UsePCACondition, !Ref DsPCACertificate, !Ref DsCertificate]
  RsWebAclArn:
    Description: The ARN of the Rs WebACL
    Value: !GetAtt RsWebAcl.Arn
  DsWebAclArn:
    Description: The ARN of the Ds WebACL
    Value: !GetAtt DsWebAcl.Arn