# =====================================================================
# modules/web-asg/variables.tf
# =====================================================================

variable "name" {
  description = "Short name used as a prefix for every resource (for example orders-prod)."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{1,20}$", var.name))
    error_message = "name must be 2 to 21 chars, lowercase letters, digits and hyphens, starting with a letter."
  }
}

variable "environment" {
  description = "dev, staging or prod. Drives the single-NAT default and tags."
  type        = string

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment must be dev, staging or prod."
  }
}

variable "vpc_cidr" {
  description = "VPC CIDR. A /16 gives 65,536 addresses, enough for 6 /20 subnets plus spare."
  type        = string
  default     = "10.40.0.0/16"

  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0)) && tonumber(split("/", var.vpc_cidr)[1]) <= 20
    error_message = "vpc_cidr must be a valid IPv4 CIDR no smaller than /20."
  }
}

variable "az_count" {
  description = "Number of availability zones to use. 3 is the production default."
  type        = number
  default     = 3

  validation {
    condition     = var.az_count >= 2 && var.az_count <= 4
    error_message = "az_count must be between 2 and 4."
  }
}

variable "single_nat_gateway" {
  description = "true = one NAT gateway for all private subnets (cheap, dev). false = one per AZ (prod)."
  type        = bool
  default     = false
}

variable "eks_cluster_name" {
  description = "If set, subnets get the tags the AWS Load Balancer Controller and Karpenter use for discovery."
  type        = string
  default     = ""
}

variable "instance_type" {
  description = "EC2 instance type for the web tier."
  type        = string
  default     = "t3.small"
}

variable "ami_ssm_parameter" {
  description = "SSM public parameter that resolves to the AMI id. No AMI ids are hard-coded."
  type        = string
  default     = "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64"
}

variable "asg_min_size" {
  description = "Minimum instances. 3 in prod so one per AZ survives a zone loss."
  type        = number
  default     = 3
}

variable "asg_max_size" {
  description = "Maximum instances the target tracking policy may reach."
  type        = number
  default     = 12

  validation {
    condition     = var.asg_max_size >= var.asg_min_size
    error_message = "asg_max_size must be at least asg_min_size."
  }
}

variable "app_port" {
  description = "Port the application listens on behind the ALB."
  type        = number
  default     = 8080
}

variable "health_check_path" {
  description = "HTTP path the ALB target group probes. Must return 200 only when ready."
  type        = string
  default     = "/readyz"
}

variable "requests_per_target" {
  description = "Target tracking goal: ALB requests per instance per minute. Measure it from a load test."
  type        = number
  default     = 3000
}

variable "certificate_arn" {
  description = "ACM certificate for the HTTPS listener. Empty = HTTP only (dev)."
  type        = string
  default     = ""
}

variable "tags" {
  description = "Extra tags merged into every resource."
  type        = map(string)
  default     = {}
}

# =====================================================================
# modules/web-asg/main.tf
# =====================================================================

terraform {
  required_version = ">= 1.9.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Only real AZs, not Local Zones (those need an opt-in and have no NAT).
data "aws_availability_zones" "available" {
  state = "available"
  filter {
    name   = "opt-in-status"
    values = ["opt-in-not-required"]
  }
}

# The AMI id comes from AWS's public SSM parameter, so every plan picks the
# current Amazon Linux 2023 image and nothing in git goes stale.
data "aws_ssm_parameter" "ami" {
  name = var.ami_ssm_parameter
}

locals {
  azs = slice(data.aws_availability_zones.available.names, 0, var.az_count)

  # Subnet layout with cidrsubnet(prefix, newbits, netnum):
  #   /16 + 4 newbits = /20 (4,096 addresses each), 16 possible slots.
  #   public  subnets take slots 0..az_count-1
  #   private subnets take slots 8..8+az_count-1  (leaves room for a 4th AZ or a db tier)
  public_subnets  = { for i, az in local.azs : az => cidrsubnet(var.vpc_cidr, 4, i) }
  private_subnets = { for i, az in local.azs : az => cidrsubnet(var.vpc_cidr, 4, i + 8) }

  # dev saves ~2 NAT gateways; prod keeps one per AZ so a zone loss does not
  # cut outbound traffic for the other zones.
  nat_azs = var.single_nat_gateway ? [local.azs[0]] : local.azs

  eks_tags = var.eks_cluster_name == "" ? {} : {
    "kubernetes.io/cluster/${var.eks_cluster_name}" = "shared"
    "karpenter.sh/discovery"                        = var.eks_cluster_name
  }

  common_tags = merge(var.tags, {
    Name        = var.name
    Environment = var.environment
    ManagedBy   = "terraform"
  })
}

# ---------- VPC and gateways ----------

resource "aws_vpc" "this" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true # needed for EKS, RDS endpoints and private hosted zones
  tags                 = local.common_tags
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id
  tags   = local.common_tags
}

resource "aws_subnet" "public" {
  for_each = local.public_subnets

  vpc_id                  = aws_vpc.this.id
  cidr_block              = each.value
  availability_zone       = each.key
  map_public_ip_on_launch = false # ALB and NAT get addresses; instances never do

  tags = merge(local.common_tags, local.eks_tags, {
    Name                     = "${var.name}-public-${each.key}"
    Tier                     = "public"
    "kubernetes.io/role/elb" = "1" # AWS Load Balancer Controller: internet-facing LBs go here
  })
}

resource "aws_subnet" "private" {
  for_each = local.private_subnets

  vpc_id            = aws_vpc.this.id
  cidr_block        = each.value
  availability_zone = each.key

  tags = merge(local.common_tags, local.eks_tags, {
    Name                              = "${var.name}-private-${each.key}"
    Tier                              = "private"
    "kubernetes.io/role/internal-elb" = "1" # internal LBs and Karpenter nodes go here
  })
}

resource "aws_eip" "nat" {
  for_each = toset(local.nat_azs)

  domain = "vpc"
  tags   = merge(local.common_tags, { Name = "${var.name}-nat-${each.key}" })
}

resource "aws_nat_gateway" "this" {
  for_each = toset(local.nat_azs)

  allocation_id = aws_eip.nat[each.key].id
  subnet_id     = aws_subnet.public[each.key].id
  tags          = merge(local.common_tags, { Name = "${var.name}-nat-${each.key}" })

  # The provider docs recommend an explicit dependency so the IGW exists first.
  depends_on = [aws_internet_gateway.this]
}

# ---------- Route tables ----------

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id
  tags   = merge(local.common_tags, { Name = "${var.name}-public" })
}

resource "aws_route" "public_internet" {
  route_table_id         = aws_route_table.public.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.this.id
}

resource "aws_route_table_association" "public" {
  for_each = aws_subnet.public

  subnet_id      = each.value.id
  route_table_id = aws_route_table.public.id
}

# One private route table per AZ so each AZ can point at its own NAT.
resource "aws_route_table" "private" {
  for_each = aws_subnet.private

  vpc_id = aws_vpc.this.id
  tags   = merge(local.common_tags, { Name = "${var.name}-private-${each.key}" })
}

resource "aws_route" "private_nat" {
  for_each = aws_subnet.private

  route_table_id         = aws_route_table.private[each.key].id
  destination_cidr_block = "0.0.0.0/0"
  # With a single NAT every AZ routes to the one in the first AZ.
  nat_gateway_id = var.single_nat_gateway ? aws_nat_gateway.this[local.azs[0]].id : aws_nat_gateway.this[each.key].id
}

resource "aws_route_table_association" "private" {
  for_each = aws_subnet.private

  subnet_id      = each.value.id
  route_table_id = aws_route_table.private[each.key].id
}

# ---------- Security groups (least privilege, rules as separate resources) ----------

resource "aws_security_group" "alb" {
  name_prefix = "${var.name}-alb-"
  description = "ALB: 80/443 from the internet"
  vpc_id      = aws_vpc.this.id
  tags        = merge(local.common_tags, { Name = "${var.name}-alb" })

  lifecycle {
    create_before_destroy = true # a renamed SG must exist before the old one is removed from the ALB
  }
}

resource "aws_vpc_security_group_ingress_rule" "alb_http" {
  security_group_id = aws_security_group.alb.id
  description       = "HTTP from anywhere, redirected to HTTPS by the listener"
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "tcp"
  from_port         = 80
  to_port           = 80
}

resource "aws_vpc_security_group_ingress_rule" "alb_https" {
  count = var.certificate_arn == "" ? 0 : 1

  security_group_id = aws_security_group.alb.id
  description       = "HTTPS from anywhere"
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
}

resource "aws_vpc_security_group_egress_rule" "alb_to_app" {
  security_group_id            = aws_security_group.alb.id
  description                  = "Only to the app port on the instances"
  referenced_security_group_id = aws_security_group.app.id
  ip_protocol                  = "tcp"
  from_port                    = var.app_port
  to_port                      = var.app_port
}

resource "aws_security_group" "app" {
  name_prefix = "${var.name}-app-"
  description = "Web instances: app port from the ALB only"
  vpc_id      = aws_vpc.this.id
  tags        = merge(local.common_tags, { Name = "${var.name}-app" })

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "app_from_alb" {
  security_group_id            = aws_security_group.app.id
  description                  = "App port from the ALB security group, never from a CIDR"
  referenced_security_group_id = aws_security_group.alb.id
  ip_protocol                  = "tcp"
  from_port                    = var.app_port
  to_port                      = var.app_port
}

resource "aws_vpc_security_group_egress_rule" "app_all" {
  security_group_id = aws_security_group.app.id
  description       = "Outbound through NAT for packages, SSM and the database"
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

# ---------- IAM for SSM Session Manager (no SSH, no key pairs) ----------

data "aws_iam_policy_document" "ec2_assume" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "app" {
  name_prefix        = "${var.name}-app-"
  assume_role_policy = data.aws_iam_policy_document.ec2_assume.json
  tags               = local.common_tags
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.app.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "app" {
  name_prefix = "${var.name}-app-"
  role        = aws_iam_role.app.name
}

# ---------- Launch template ----------

resource "aws_launch_template" "app" {
  name_prefix            = "${var.name}-"
  image_id               = data.aws_ssm_parameter.ami.value
  instance_type          = var.instance_type
  update_default_version = true # each change becomes the default version the ASG follows
  vpc_security_group_ids = [aws_security_group.app.id]

  iam_instance_profile {
    name = aws_iam_instance_profile.app.name
  }

  # IMDSv2 only: a stolen SSRF cannot read instance credentials with a plain GET.
  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = 1
    instance_metadata_tags      = "enabled"
  }

  monitoring {
    enabled = true # 1-minute CloudWatch metrics; needed for scaling that reacts in time
  }

  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size           = 20
      volume_type           = "gp3"
      encrypted             = true
      delete_on_termination = true
    }
  }

  # Minimal user data: install the app from a release artifact and start it.
  # Real projects bake the app into the AMI and keep this to configuration.
  user_data = base64encode(templatefile("${path.module}/user_data.sh.tftpl", {
    app_port    = var.app_port
    environment = var.environment
  }))

  tag_specifications {
    resource_type = "instance"
    tags          = merge(local.common_tags, { Name = "${var.name}-app" })
  }

  lifecycle {
    create_before_destroy = true
  }
}

# ---------- Load balancer ----------

resource "aws_lb" "this" {
  name                       = "${var.name}-alb"
  internal                   = false
  load_balancer_type         = "application"
  security_groups            = [aws_security_group.alb.id]
  subnets                    = [for s in aws_subnet.public : s.id]
  drop_invalid_header_fields = true
  idle_timeout               = 60
  enable_deletion_protection = var.environment == "prod"
  tags                       = local.common_tags
}

resource "aws_lb_target_group" "app" {
  name_prefix          = "app-" # at most 6 characters
  port                 = var.app_port
  protocol             = "HTTP"
  vpc_id               = aws_vpc.this.id
  target_type          = "instance"
  deregistration_delay = 30 # seconds to drain in-flight requests before an instance is removed

  health_check {
    enabled             = true
    path                = var.health_check_path
    port                = "traffic-port"
    protocol            = "HTTP"
    interval            = 15
    timeout             = 5
    healthy_threshold   = 2 # in service after 30 s of passing checks
    unhealthy_threshold = 3 # out after 45 s of failing checks
    matcher             = "200"
  }

  tags = local.common_tags

  # A target group in use by a listener cannot be deleted first; name_prefix
  # plus create_before_destroy lets Terraform swap it without downtime.
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.this.arn
  port              = 80
  protocol          = "HTTP"

  # With a certificate, 80 only redirects. Without one (dev) it forwards.
  dynamic "default_action" {
    for_each = var.certificate_arn == "" ? [1] : []
    content {
      type             = "forward"
      target_group_arn = aws_lb_target_group.app.arn
    }
  }

  dynamic "default_action" {
    for_each = var.certificate_arn == "" ? [] : [1]
    content {
      type = "redirect"
      redirect {
        port        = "443"
        protocol    = "HTTPS"
        status_code = "HTTP_301"
      }
    }
  }
}

resource "aws_lb_listener" "https" {
  count = var.certificate_arn == "" ? 0 : 1

  load_balancer_arn = aws_lb.this.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = var.certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# ---------- Auto Scaling group ----------

resource "aws_autoscaling_group" "app" {
  name_prefix               = "${var.name}-"
  min_size                  = var.asg_min_size
  max_size                  = var.asg_max_size
  desired_capacity          = var.asg_min_size
  vpc_zone_identifier       = [for s in aws_subnet.private : s.id] # one subnet per AZ = spread by AWS
  target_group_arns         = [aws_lb_target_group.app.arn]
  health_check_type         = "ELB" # replace an instance the ALB marks unhealthy, not only a dead VM
  health_check_grace_period = 120   # time for user data to install and start the app
  default_instance_warmup   = 120   # new instances do not count in metrics until warm
  termination_policies      = ["OldestLaunchTemplate", "OldestInstance"]
  wait_for_capacity_timeout = "10m"

  launch_template {
    id      = aws_launch_template.app.id
    version = aws_launch_template.app.latest_version
  }

  # Rolling replacement whenever the launch template changes (new AMI, new
  # user data, new instance type). 90 percent healthy means at most ~10 percent
  # of capacity is being replaced at any moment.
  instance_refresh {
    strategy = "Rolling"
    preferences {
      min_healthy_percentage = 90
      max_healthy_percentage = 110
      instance_warmup        = 120
      skip_matching          = true # do not replace instances already on the new version
      auto_rollback          = true # bring back the old template if new instances fail health checks
    }
    triggers = ["tag"]
  }

  dynamic "tag" {
    for_each = merge(local.common_tags, { Name = "${var.name}-app" })
    content {
      key                 = tag.key
      value               = tag.value
      propagate_at_launch = true
    }
  }

  lifecycle {
    create_before_destroy = true
    # The scaling policy moves desired_capacity; Terraform must not reset it on every apply.
    ignore_changes = [desired_capacity]
  }
}

# Target tracking on ALB requests per target keeps each instance at a known load.
resource "aws_autoscaling_policy" "requests" {
  name                      = "${var.name}-requests-per-target"
  autoscaling_group_name    = aws_autoscaling_group.app.name
  policy_type               = "TargetTrackingScaling"
  estimated_instance_warmup = 120

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ALBRequestCountPerTarget"
      # Format: app/<alb-name>/<id>/targetgroup/<tg-name>/<id>, built from the two ARN suffixes.
      resource_label = "${aws_lb.this.arn_suffix}/${aws_lb_target_group.app.arn_suffix}"
    }
    target_value     = var.requests_per_target
    disable_scale_in = false
  }
}

# =====================================================================
# modules/web-asg/outputs.tf
# =====================================================================

output "vpc_id" {
  description = "VPC id for other modules (RDS, EKS) to attach to."
  value       = aws_vpc.this.id
}

output "public_subnet_ids" {
  description = "Public subnet ids keyed by AZ."
  value       = { for az, s in aws_subnet.public : az => s.id }
}

output "private_subnet_ids" {
  description = "Private subnet ids keyed by AZ."
  value       = { for az, s in aws_subnet.private : az => s.id }
}

output "nat_gateway_public_ips" {
  description = "Egress IPs to allow-list at third parties."
  value       = [for e in aws_eip.nat : e.public_ip]
}

output "alb_dns_name" {
  description = "Point a Route 53 alias record at this."
  value       = aws_lb.this.dns_name
}

output "alb_zone_id" {
  description = "Hosted zone id of the ALB, needed for the alias record."
  value       = aws_lb.this.zone_id
}

output "asg_name" {
  description = "Auto Scaling group name, for CloudWatch dashboards and instance refresh commands."
  value       = aws_autoscaling_group.app.name
}

output "app_security_group_id" {
  description = "Attach this to the database security group as the allowed source."
  value       = aws_security_group.app.id
}

# =====================================================================
# Root module usage: envs/prod/main.tf
# =====================================================================

module "web_prod" {
  source = "../../modules/web-asg"

  name               = "orders-prod"
  environment        = "prod"
  vpc_cidr           = "10.40.0.0/16"
  az_count           = 3
  single_nat_gateway = false
  eks_cluster_name   = "orders-prod"
  instance_type      = "t3.small"
  asg_min_size       = 3
  asg_max_size       = 12
  certificate_arn    = "arn:aws:acm:ap-south-1:111122223333:certificate/REPLACE-ME"

  tags = {
    Team       = "payments"
    CostCenter = "cc-1234"
  }
}

# envs/dev/main.tf differs in: environment = "dev", single_nat_gateway = true,
# asg_min_size = 1, asg_max_size = 2, certificate_arn = "".