terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

variable "kubeconfig_path" {
  type        = string
  description = "the kubeconfig file path of the k8s running cluster-ng-server"
}

variable "admin_user" {
  type        = string
  description = "the admin user for the RDS instance"
}

variable "admin_pass" {
  type        = string
  description = "the pass of the admin user for the RDS instance"
}

variable "endpoint" {
  type        = string
  description = "RDS endpoint"
}

variable "service_name" {
  type        = string
  description = "which service we create the db for"
}

variable "logical_region_name" {
  type        = string
  description = "the tidbcloud region the db used for"
}

variable "env" {
  type        = string
  description = "tidbcloud environment of the rds used for"
}

resource "random_password" "this" {
  length  = 16
  special = false
  upper   = true
  numeric = true
}

locals {
  account_name     = "${replace(var.service_name, "-", "_")}_${substr(md5(var.logical_region_name), 0, 16)}"
  database_name    = "${var.logical_region_name}-${replace(var.service_name, "_", "-")}"
  account_password = random_password.this.result
}

resource "aws_secretsmanager_secret" "this" {
  name                    = "${var.env}-${local.database_name}"
  recovery_window_in_days = 0
}

resource "aws_secretsmanager_secret_version" "this" {
  secret_id = aws_secretsmanager_secret.this.id
  secret_string = jsonencode({
    username = local.account_name
    password = local.account_password
  })
}

data "external" "github_settings" {
  program = ["bash", "-c", <<-EOT
        cat <<EOF
        {
            "gh_token": "$GH_TOKEN",
            "gh_rev": "$(git rev-parse HEAD)"
        }
        EOF
    EOT
  ]

  lifecycle {
    postcondition {
      condition     = self.result.gh_token != ""
      error_message = "env GH_TOKEN not set"
    }
  }
}

module "init-rds-db" {
  source          = "../../../modules/remote_python"
  kubeconfig_path = var.kubeconfig_path

  script_url = join("", [
    "https://",
    data.external.github_settings.result.gh_token,
    "@raw.githubusercontent.com/tidbcloud/auto-deploy/",
    chomp(data.external.github_settings.result.gh_rev),
    "/scripts/init-aws-rds-database.py",
  ])
  script_parameters = [
    "--host", var.endpoint,
    "--port", "3306",
    "--admin-user", var.admin_user,
    "--admin-pass", var.admin_pass,
    "--db-name", local.database_name,
    "--db-user", local.account_name,
    "--db-pass", local.account_password,
  ]

  destroy_script_url = join("", [
    "https://",
    data.external.github_settings.result.gh_token,
    "@raw.githubusercontent.com/tidbcloud/auto-deploy/",
    chomp(data.external.github_settings.result.gh_rev),
    "/scripts/destroy-aws-rds-database.py",
  ])
  destroy_script_parameters = [
    "--host", var.endpoint,
    "--port", "3306",
    "--admin-user", var.admin_user,
    "--admin-pass", var.admin_pass,
    "--db-name", local.database_name,
    "--db-user", local.account_name,
  ]
}

output "database_name" {
  value = local.database_name
}

output "account_name" {
  value = local.account_name
}

output "password_secret_name" {
  value = aws_secretsmanager_secret.this.name
}

output "password_secret_arn" {
  value = aws_secretsmanager_secret.this.arn
}