# =============================================================================
# PrivateLink — ported from the tail of the basic/addon script and
# vpc-endpoint-service.yaml:
#   wait for the nginx-write NLB -> VPC endpoint service (acceptance not
#   required, private DNS name) -> allowed principals -> Route53 verification
#   TXT -> private DNS verification -> S3 gateway endpoint on all route tables.
# =============================================================================

locals {
  # The nginx-write NLB and the endpoint service private DNS name are derived
  # from the node-group AZ, same as jobOptions.o11y.zone in the old scripts
  zone                 = var.availability_zones[0]
  zone_suffix          = trimprefix(local.zone, var.aws_region)
  endpoint_service_dns = "prometheus-endpoint-${local.zone_suffix}.${local.hosted_zone_name}"
  nginx_write_nlb_name = "ngx-w-${var.logical_region_name}"
}

resource "null_resource" "wait_ngx_w_active" {
  depends_on = [module.cloud-addon-cd]

  triggers = {
    aws_profile = local.o11y_account
    aws_region  = var.aws_region
    nlb_name    = local.nginx_write_nlb_name
  }

  provisioner "local-exec" {
    when        = create
    interpreter = ["bash", "-c"]
    command     = <<-EOT
      aws elbv2 wait load-balancer-available \
        --profile ${self.triggers.aws_profile} \
        --region ${self.triggers.aws_region} \
        --names ${self.triggers.nlb_name}
    EOT
  }
}

data "aws_lb" "ngx_w" {
  depends_on = [null_resource.wait_ngx_w_active, module.cloud-addon-cd]

  name = local.nginx_write_nlb_name
}

resource "aws_vpc_endpoint_service" "this" {
  acceptance_required        = false
  network_load_balancer_arns = [data.aws_lb.ngx_w.arn]
  private_dns_name           = local.endpoint_service_dns

  tags = merge(local.common_tags, {
    Name = "${local.cluster_name}-vpc-endpoint-service"
  })
}

resource "aws_vpc_endpoint_service_allowed_principal" "this" {
  for_each = toset(var.nlb_allowed_principals)

  vpc_endpoint_service_id = aws_vpc_endpoint_service.this.id
  principal_arn           = each.value
}

# Domain-ownership TXT record for the endpoint service private DNS name.
# AWS returns the record name/value in private_dns_name_configuration; the
# record FQDN is "<name>.<private_dns_name>".
resource "aws_route53_record" "endpoint_service_verification" {
  zone_id = data.aws_route53_zone.this.zone_id
  name    = "${aws_vpc_endpoint_service.this.private_dns_name_configuration[0].name}.${local.endpoint_service_dns}"
  type    = aws_vpc_endpoint_service.this.private_dns_name_configuration[0].type
  records = [aws_vpc_endpoint_service.this.private_dns_name_configuration[0].value]
  ttl     = 300
}

resource "aws_vpc_endpoint_service_private_dns_verification" "this" {
  service_id = aws_vpc_endpoint_service.this.id

  depends_on = [aws_route53_record.endpoint_service_verification]
}

# S3 gateway endpoint attached to every route table of the VPC, so vmcluster /
# loki / backup traffic to S3 stays off the NAT gateway.
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = module.vpc.vpc_id
  service_name      = "com.amazonaws.${var.aws_region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = local.vpc_route_table_ids

  tags = merge(local.common_tags, {
    Name = "${local.cluster_name}-s3-gateway-endpoint"
  })
}