# =============================================================================
# RDS — read from o11y-region-shared state
# =============================================================================

data "aws_s3_object" "o11y_region_shared_state" {
  bucket = "autonomous-deployment-terraform-state"
  key    = "alicloud/o11y-region-shared/${var.env}-${var.cloud_region}.json"

  provider = aws.tf_state
}

locals {
  rds_instance_id       = jsondecode(data.aws_s3_object.o11y_region_shared_state.body).outputs.rds_instance_id.value
  rds_connection_string = jsondecode(data.aws_s3_object.o11y_region_shared_state.body).outputs.rds_public_connection_string.value
  rds_port              = tonumber(jsondecode(data.aws_s3_object.o11y_region_shared_state.body).outputs.rds_port.value)
  kms_instance_id       = jsondecode(data.aws_s3_object.o11y_region_shared_state.body).outputs.kms_instance_id.value
  kms_default_key_id    = jsondecode(data.aws_s3_object.o11y_region_shared_state.body).outputs.kms_default_key_id.value
}

# =============================================================================
# RDS Whitelist
# =============================================================================

resource "alicloud_rds_whitelist_template" "white_list_for_k8s" {
  ip_white_list = alicloud_eip_address.nat.ip_address
  template_name = "${local.cluster_name}-whitelist-template"
}

resource "null_resource" "alicloud_db_whitelist_template_attachment" {
  triggers = {
    o11y_account = local.alicloud_account
    instance_id  = local.rds_instance_id
    template_id  = alicloud_rds_whitelist_template.white_list_for_k8s.id
    region       = var.cloud_region
  }

  provisioner "local-exec" {
    command = <<-EOT
        aliyun rds AttachWhitelistTemplateToInstance \
            --profile ${self.triggers.o11y_account} \
            --region ${self.triggers.region} \
            --InsName ${self.triggers.instance_id} \
            --TemplateId ${self.triggers.template_id}
    EOT
    when    = create
  }

  provisioner "local-exec" {
    command = <<-EOT
        aliyun rds DetachWhitelistTemplateToInstance \
            --profile ${self.triggers.o11y_account} \
            --region ${self.triggers.region} \
            --InsName ${self.triggers.instance_id} \
            --TemplateId ${self.triggers.template_id}
    EOT
    when    = destroy
  }
}

# =============================================================================
# RDS Account
# =============================================================================

resource "random_password" "rds" {
  length           = 16
  special          = true
  override_special = "!@#$%^&*()_+-="
}

resource "alicloud_rds_account" "this" {
  db_instance_id   = local.rds_instance_id
  account_name     = "o11y_${substr(md5(var.logical_region_name), 0, 16)}"
  account_password = random_password.rds.result
}

# =============================================================================
# RDS Database
# =============================================================================


resource "alicloud_db_database" "kubestore" {
  instance_id    = local.rds_instance_id
  data_base_name = "${var.logical_region_name}-kubestore"
  character_set  = "utf8mb4"
  description    = "Kubestore database"
}

# =============================================================================
# Account Privilege
# =============================================================================


resource "alicloud_db_account_privilege" "kubestore" {
  instance_id  = local.rds_instance_id
  account_name = alicloud_rds_account.this.account_name
  db_names     = [alicloud_db_database.kubestore.data_base_name]
  privilege    = "ReadWrite"
}

# =============================================================================
# KMS Secret
# =============================================================================

locals {
  rds_credentials_json = jsonencode({
    host         = local.rds_connection_string
    port         = local.rds_port
    username     = alicloud_rds_account.this.account_name
    password     = random_password.rds.result
    dbname       = alicloud_db_database.kubestore.data_base_name
    dbInstanceId = local.rds_instance_id
  })
}

resource "alicloud_kms_secret" "rds_credentials" {
  secret_name                   = "o11y-${var.env}-regional-${var.logical_region_name}-rds-credentials"
  secret_data                   = local.rds_credentials_json
  secret_data_type              = "text"
  version_id                    = "v2"
  dkms_instance_id              = local.kms_instance_id
  encryption_key_id             = local.kms_default_key_id
  force_delete_without_recovery = true

  depends_on = [
    alicloud_rds_account.this,
    alicloud_db_database.kubestore,
  ]
}

# =============================================================================
# Outputs
# =============================================================================

output "rds_instance_id" {
  value       = local.rds_instance_id
  description = "RDS instance ID"
}

output "rds_connection_string" {
  value       = local.rds_connection_string
  description = "RDS private connection string"
}

output "rds_credentials" {
  sensitive   = true
  description = "RDS connection credentials JSON (equivalent to init_db.sh output)"
  value = jsonencode({
    host         = local.rds_connection_string
    port         = local.rds_port
    username     = alicloud_rds_account.this.account_name
    password     = random_password.rds.result
    dbname       = alicloud_db_database.kubestore.data_base_name
    dbInstanceId = local.rds_instance_id
  })
}

output "rds_secret_name" {
  value       = alicloud_kms_secret.rds_credentials.secret_name
  description = "KMS secret name storing RDS credentials"
}