locals {
  private_service_ports = {
    mysql           = local.ports.mysql
    kafka_anonymous = local.ports.kafka_pl_public
    kafka_sasl      = local.ports.kafka_pl_sasl
  }
  privatelink_consumer_account_ids = setsubtract(var.privatelink_allowed_account_ids, toset([var.target_account_id]))
}

resource "alicloud_nlb_load_balancer" "services" {
  count = local.privatelink_enabled ? 1 : 0

  load_balancer_name             = "${local.deployment_name}-services"
  load_balancer_type             = "Network"
  address_type                   = "Intranet"
  address_ip_version             = "Ipv4"
  vpc_id                         = alicloud_vpc.this.id
  cross_zone_enabled             = true
  deletion_protection_enabled    = false
  modification_protection_status = "NonProtection"
  tags                           = local.tags

  dynamic "zone_mappings" {
    for_each = alicloud_vswitch.services
    content {
      vswitch_id = zone_mappings.value.id
      zone_id    = zone_mappings.value.zone_id
    }
  }
}

resource "alicloud_nlb_server_group" "services" {
  for_each = local.privatelink_enabled ? local.private_service_ports : {}

  server_group_name          = "${local.deployment_name}-${replace(each.key, "_", "-")}"
  server_group_type          = "Instance"
  vpc_id                     = alicloud_vpc.this.id
  protocol                   = "TCP"
  scheduler                  = "Wrr"
  address_ip_version         = "Ipv4"
  connection_drain_enabled   = true
  connection_drain_timeout   = 30
  preserve_client_ip_enabled = false
  tags                       = local.tags

  health_check {
    health_check_enabled         = true
    health_check_type            = "TCP"
    health_check_connect_port    = each.value
    health_check_connect_timeout = 5
    health_check_interval        = 5
    healthy_threshold            = 2
    unhealthy_threshold          = 2
  }
}

resource "alicloud_nlb_server_group_server_attachment" "services" {
  for_each = local.privatelink_enabled ? local.private_service_ports : {}

  server_group_id = alicloud_nlb_server_group.services[each.key].id
  server_id       = alicloud_instance.services.id
  server_type     = "Ecs"
  port            = each.value
  weight          = 100
  description     = "Date Integration ${each.key} backend"

  depends_on = [alicloud_ecs_disk_attachment.data]
}

resource "alicloud_nlb_listener" "services" {
  for_each = local.privatelink_enabled ? local.private_service_ports : {}

  load_balancer_id       = alicloud_nlb_load_balancer.services[0].id
  server_group_id        = alicloud_nlb_server_group.services[each.key].id
  listener_protocol      = "TCP"
  listener_port          = each.value
  listener_description   = "${local.deployment_name}-${replace(each.key, "_", "-")}"
  idle_timeout           = 900
  proxy_protocol_enabled = false
  cps                    = 0
  tags                   = local.tags
}

resource "alicloud_privatelink_vpc_endpoint_service" "services" {
  count = local.privatelink_enabled ? 1 : 0

  service_description    = "${local.deployment_name} MySQL and Kafka"
  service_resource_type  = "nlb"
  auto_accept_connection = true
  payer                  = "Endpoint"
  zone_affinity_enabled  = false
  tags                   = local.tags
}

resource "alicloud_privatelink_vpc_endpoint_service_resource" "services" {
  for_each = local.privatelink_enabled ? {
    for vswitch in alicloud_vswitch.services : vswitch.zone_id => vswitch
  } : {}

  service_id    = alicloud_privatelink_vpc_endpoint_service.services[0].id
  resource_id   = alicloud_nlb_load_balancer.services[0].id
  resource_type = "nlb"
  zone_id       = each.key

  depends_on = [alicloud_nlb_listener.services]
}

resource "alicloud_privatelink_vpc_endpoint_service_user" "consumers" {
  for_each = local.privatelink_enabled ? local.privatelink_consumer_account_ids : toset([])

  service_id = alicloud_privatelink_vpc_endpoint_service.services[0].id
  user_id    = each.value
}