resource "google_compute_instance_group" "services" {
  count = local.privatelink_enabled ? 1 : 0

  name      = "${local.deployment_name}-services"
  project   = var.gcp_project_id
  zone      = local.gcp_zone
  instances = [google_compute_instance.this.self_link]
}

resource "google_compute_health_check" "services" {
  count = local.privatelink_enabled ? 1 : 0

  name        = "${local.deployment_name}-services"
  project     = var.gcp_project_id
  description = "usedby=${local.deployment_name}; shared MySQL/Kafka health check"
  tcp_health_check {
    port = local.ports.mysql
  }
}

resource "google_compute_region_backend_service" "services" {
  count = local.privatelink_enabled ? 1 : 0

  name                  = "${local.deployment_name}-services"
  project               = var.gcp_project_id
  region                = var.gcp_region
  protocol              = "TCP"
  load_balancing_scheme = "INTERNAL"
  network               = google_compute_network.this.id
  description           = "usedby=${local.deployment_name}; shared MySQL/Kafka PSC backend"
  health_checks         = [google_compute_health_check.services[0].id]
  backend {
    group          = google_compute_instance_group.services[0].id
    balancing_mode = "CONNECTION"
  }
}

resource "google_compute_address" "services_internal" {
  count = local.privatelink_enabled ? 1 : 0

  name         = "${local.deployment_name}-services-ilb"
  project      = var.gcp_project_id
  region       = var.gcp_region
  address_type = "INTERNAL"
  subnetwork   = google_compute_subnetwork.services.id
  labels       = local.labels
}

resource "google_compute_forwarding_rule" "services" {
  count = local.privatelink_enabled ? 1 : 0

  name                  = "${local.deployment_name}-services"
  project               = var.gcp_project_id
  region                = var.gcp_region
  load_balancing_scheme = "INTERNAL"
  network               = google_compute_network.this.id
  subnetwork            = google_compute_subnetwork.services.id
  ip_address            = google_compute_address.services_internal[0].address
  ip_protocol           = "TCP"
  ports = [
    tostring(local.ports.mysql),
    tostring(local.ports.kafka_pl_public),
    tostring(local.ports.kafka_pl_sasl),
  ]
  backend_service = google_compute_region_backend_service.services[0].id
  labels          = local.labels
}

resource "google_compute_service_attachment" "services" {
  count = local.privatelink_enabled ? 1 : 0

  name                  = "${local.deployment_name}-services"
  project               = var.gcp_project_id
  region                = var.gcp_region
  connection_preference = "ACCEPT_MANUAL"
  reconcile_connections = true
  enable_proxy_protocol = false
  nat_subnets           = [google_compute_subnetwork.psc.id]
  target_service        = google_compute_forwarding_rule.services[0].id
  description           = "usedby=${local.deployment_name}; shared MySQL/Kafka Private Service Connect producer"

  dynamic "consumer_accept_lists" {
    for_each = var.private_service_connect_project_ids

    content {
      project_id_or_num = consumer_accept_lists.value
      connection_limit  = 10
    }
  }
}