resource "random_password" "admin" {
  length           = 20
  special          = true
  override_special = "!@#$%^&*()_+-="
}

locals {
  admin_password    = var.admin_password != "" ? var.admin_password : random_password.admin.result
  admin_secret_name = var.admin_password_secret_name
  mysql_name        = var.name != "" ? var.name : "${var.env}-${var.cloud_region}-rds"
  resource_group    = var.resource_group_name != "" ? var.resource_group_name : "${var.env}-${var.cloud_region}-shared"
  key_vault_name    = var.key_vault_name != "" ? var.key_vault_name : "k${substr(md5("${var.env}-${var.cloud_region}-${local.controlplane_subscription}"), 0, 19)}"
  tags = {
    environment = var.env
    usedby      = "dbaas-control-plane-seed"
    servicetype = "nextgen"
    tenant      = "admin"
  }
}

resource "azurerm_resource_group" "this" {
  name     = local.resource_group
  location = var.cloud_region
  tags     = local.tags
}

resource "azurerm_mysql_flexible_server" "this" {
  name                = local.mysql_name
  location            = var.cloud_region
  resource_group_name = azurerm_resource_group.this.name

  administrator_login    = var.admin_username
  administrator_password = local.admin_password

  sku_name = var.sku_name
  version  = var.mysql_version

  storage {
    size_gb = var.storage_gb
  }

  backup_retention_days = var.backup_retention_days
  public_network_access = "Disabled"

  tags = local.tags
}

resource "azurerm_mysql_flexible_server_configuration" "require_secure_transport" {
  name                = "require_secure_transport"
  resource_group_name = azurerm_mysql_flexible_server.this.resource_group_name
  server_name         = azurerm_mysql_flexible_server.this.name
  value               = var.require_secure_transport ? "ON" : "OFF"
}

output "server_name" {
  value = azurerm_mysql_flexible_server.this.name
}

output "host" {
  value = azurerm_mysql_flexible_server.this.fqdn
}

output "port" {
  value = 3306
}

output "admin_username" {
  value = var.admin_username
}

output "admin_password_secret_name" {
  value = local.admin_secret_name
}

output "resource_group_name" {
  value = azurerm_resource_group.this.name
}