resource "aws_security_group" "clinic_http" {
  name        = "${local.o11y_name}-clinic-http-sg"
  description = "Security group for VPC endpoint to allow HTTP traffic"
  vpc_id      = module.vpc.vpc_id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = [var.vpc.cidr]
  }

  egress = []
}

resource "aws_vpc_endpoint" "clinic" {
  service_name        = var.clinic_endpoint_service_name
  service_region      = "us-west-2"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = false

  vpc_id             = module.vpc.vpc_id
  subnet_ids         = module.vpc.private_subnets
  security_group_ids = [aws_security_group.clinic_http.id]

  tags = merge({
    Name        = "${local.o11y_name}-clinic"
    ManagedBy   = "PingCAP"
    environment = var.env
  }, var.tags)
}

data "aws_secretsmanager_secret_version" "clinic_password" {
  secret_id = "clinic-auto-deploy-token"

  provider = aws.seed
}

locals {
  clinic_secret_string = data.aws_secretsmanager_secret_version.clinic_password.secret_string
  clinic_username      = jsondecode(local.clinic_secret_string).clinicUserName
  clinic_password      = jsondecode(local.clinic_secret_string).clinicPassword
  clinic_url           = var.env == "prod" ? "http://clinic.pingcap.com:8085" : "http://staging-clinic.pingcap.com:8085"
}

data "http" "clinic_token" {
  url = "${local.clinic_url}/api/byoc/v1/orgs/${var.byoc_tenant_id}/token"

  request_headers = {
    Authorization = "Basic ${base64encode("${local.clinic_username}:${local.clinic_password}")}"
  }
}

locals {
  am_token           = jsondecode(data.http.clinic_token.response_body)
  am_username        = local.am_token.username
  am_password        = local.am_token.password
  clinic_dns_entry   = aws_vpc_endpoint.clinic.dns_entry[0].dns_name
  clinic_secret_name = "clinic-alert-proxy-basic-auth"
}

resource "kubernetes_secret_v1" "clinic_alert_proxy_basic_auth_default" {
  depends_on = [module.kubeconfig, module.eks]

  metadata {
    name      = local.clinic_secret_name
    namespace = "default"
  }

  type = "Opaque"

  data = {
    username = local.am_username
    password = local.am_password
  }
}

resource "kubernetes_namespace_v1" "self_monitoring" {
  depends_on = [module.kubeconfig, module.eks]

  metadata {
    name = "self-monitoring"
  }
}

resource "kubernetes_secret_v1" "clinic_alert_proxy_basic_auth_self_monitoring" {
  depends_on = [kubernetes_namespace_v1.self_monitoring]

  metadata {
    name      = local.clinic_secret_name
    namespace = "self-monitoring"
  }

  type = "Opaque"

  data = {
    username = local.am_username
    password = local.am_password
  }
}