resource "alicloud_vpc" "this" {
  vpc_name   = "${local.deployment_name}-vpc"
  cidr_block = var.vpc_cidr
  tags       = local.tags

  lifecycle {
    precondition {
      condition     = data.alicloud_account.current.id == var.target_account_id
      error_message = "Alibaba Cloud caller account does not match target_account_id (${var.target_account_id}, ${var.target_account_name})."
    }
    precondition {
      condition     = length(data.alicloud_nlb_zones.available.zones) >= 2
      error_message = "The selected region must provide at least two NLB zones."
    }
    precondition {
      condition     = length(local.compatible_ecs_zone_ids) > 0
      error_message = "The selected instance type must be available in at least one NLB-supported zone."
    }
  }
}

resource "alicloud_vswitch" "services" {
  count = length(local.provisioned_zone_ids)

  vpc_id       = alicloud_vpc.this.id
  cidr_block   = cidrsubnet(var.vpc_cidr, 4, count.index)
  zone_id      = local.provisioned_zone_ids[count.index]
  vswitch_name = "${local.deployment_name}-${count.index + 1}"
  tags         = local.tags
}

resource "alicloud_security_group" "services" {
  security_group_name = "${local.deployment_name}-services"
  description         = "Private-only Date Integration test services"
  vpc_id              = alicloud_vpc.this.id
  security_group_type = "normal"
  inner_access_policy = "Drop"
  tags                = local.tags
}

resource "alicloud_security_group_rule" "private_services" {
  for_each = {
    mysql     = local.ports.mysql
    anonymous = local.ports.kafka_pl_public
    sasl      = local.ports.kafka_pl_sasl
  }

  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "${each.value}/${each.value}"
  priority          = 1
  security_group_id = alicloud_security_group.services.id
  cidr_ip           = var.vpc_cidr
  description       = "Private NLB ${each.key} traffic"
}

resource "alicloud_eip_address" "services" {
  address_name         = "${local.deployment_name}-services"
  description          = "Fixed operations EIP; service security-group ingress remains private-only"
  payment_type         = "PayAsYouGo"
  internet_charge_type = "PayByTraffic"
  bandwidth            = "5"
  isp                  = "BGP"
  deletion_protection  = false
  tags                 = local.tags
}

resource "alicloud_eip_association" "services" {
  allocation_id = alicloud_eip_address.services.id
  instance_id   = alicloud_instance.services.id
  instance_type = "EcsInstance"
}