# Current Azure/Entra ID context — provides tenant_id used in outputs
data "azurerm_client_config" "current" {}

# ─── Resource Group ───────────────────────────────────────────────────

resource "azurerm_resource_group" "main" {
  name     = var.resource_group_name
  location = var.location
  tags     = var.tags
}

resource "azurerm_management_lock" "main" {
  count      = var.enable_delete_lock ? 1 : 0
  name       = "${var.prefix}-delete-lock"
  scope      = azurerm_resource_group.main.id
  lock_level = "CanNotDelete"
  notes      = "Prevents accidental deletion of production resources"
}

# ─── Networking ───────────────────────────────────────────────────────

resource "azurerm_virtual_network" "main" {
  name                = "${var.prefix}-vnet"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  address_space       = [var.vnet_address_space]
  tags                = var.tags
}

# AKS nodes subnet
resource "azurerm_subnet" "aks" {
  name                 = "${var.prefix}-aks-subnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = [var.aks_subnet_cidr]
}

# PostgreSQL Flexible Server requires a delegated subnet
resource "azurerm_subnet" "postgresql" {
  name                 = "${var.prefix}-pg-subnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = [var.pg_subnet_cidr]

  delegation {
    name = "postgresql-delegation"
    service_delegation {
      name    = "Microsoft.DBforPostgreSQL/flexibleServers"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

# ─── AKS Cluster ──────────────────────────────────────────────────────

resource "azurerm_kubernetes_cluster" "main" {
  name                = "${var.prefix}-aks"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  dns_prefix          = replace(var.prefix, "-", "")
  kubernetes_version  = var.aks_kubernetes_version
  tags                = var.tags

  default_node_pool {
    name           = "system"
    node_count     = var.aks_node_count
    vm_size        = var.aks_node_vm_size
    vnet_subnet_id = azurerm_subnet.aks.id
    node_labels = {
      prefix = var.prefix
      role   = "worker"
      env    = lookup(var.tags, "Environment", "dev")
    }
  }

  identity {
    type = "SystemAssigned"
  }

  network_profile {
    network_plugin = "azure"
    network_policy = "azure"
  }

  # Enable Workload Identity for keyless Azure service access (MSI)
  oidc_issuer_enabled       = true
  workload_identity_enabled = true
}

# ─── PostgreSQL Flexible Server ───────────────────────────────────────

# Private DNS zone: required for VNet-integrated Flexible Server
resource "azurerm_private_dns_zone" "postgresql" {
  name                = "${replace(var.prefix, "-", "")}.postgres.database.azure.com"
  resource_group_name = azurerm_resource_group.main.name
  tags                = var.tags
}

resource "azurerm_private_dns_zone_virtual_network_link" "postgresql" {
  name                  = "${var.prefix}-pg-dns-link"
  private_dns_zone_name = azurerm_private_dns_zone.postgresql.name
  resource_group_name   = azurerm_resource_group.main.name
  virtual_network_id    = azurerm_virtual_network.main.id
}

resource "random_password" "pg_admin" {
  length  = 32
  special = false
}

# Passwords for application DB users.
# NOTE: The users themselves must be created post-provision — Azure PostgreSQL
# Flexible Server has no Terraform resource for local user creation. Use
# setup scripts to run: CREATE USER keycloak/gitlab WITH PASSWORD '...';
resource "random_password" "pg_keycloak" {
  length  = 32
  special = false
}

resource "random_password" "pg_gitlab" {
  length  = 32
  special = false
}

resource "azurerm_postgresql_flexible_server" "main" {
  name                   = "${var.prefix}-postgresql"
  resource_group_name    = azurerm_resource_group.main.name
  location               = azurerm_resource_group.main.location
  version                = var.pg_version
  sku_name               = var.pg_sku_name
  storage_mb             = var.pg_storage_mb
  backup_retention_days  = var.pg_backup_retention_days
  administrator_login    = "pgadmin"
  administrator_password = random_password.pg_admin.result
  delegated_subnet_id    = azurerm_subnet.postgresql.id
  private_dns_zone_id    = azurerm_private_dns_zone.postgresql.id
  tags                   = var.tags

  dynamic "high_availability" {
    for_each = var.pg_ha_mode != "Disabled" ? [1] : []
    content {
      mode                      = var.pg_ha_mode
      standby_availability_zone = var.pg_standby_zone
    }
  }

  depends_on = [azurerm_private_dns_zone_virtual_network_link.postgresql]
}

resource "azurerm_postgresql_flexible_server_database" "keycloak" {
  name      = "keycloak"
  server_id = azurerm_postgresql_flexible_server.main.id
  collation = "en_US.utf8"
  charset   = "UTF8"
}

resource "azurerm_postgresql_flexible_server_database" "gitlab" {
  name      = "gitlabhq_production"
  server_id = azurerm_postgresql_flexible_server.main.id
  collation = "en_US.utf8"
  charset   = "UTF8"
}

# ─── Azure Cache for Redis ────────────────────────────────────────────

resource "azurerm_redis_cache" "main" {
  name                 = "${var.prefix}-redis"
  resource_group_name  = azurerm_resource_group.main.name
  location             = azurerm_resource_group.main.location
  sku_name             = var.redis_sku_name
  family               = var.redis_family
  capacity             = var.redis_capacity
  non_ssl_port_enabled = false
  minimum_tls_version  = "1.2"
  tags                 = var.tags
}

# ─── Blob Storage ─────────────────────────────────────────────────────

locals {
  # Storage account name: 3-24 chars, lowercase alphanumeric only
  storage_account_name = substr(replace(lower(var.prefix), "-", ""), 0, 19)
}

resource "azurerm_storage_account" "main" {
  name                     = "${local.storage_account_name}store"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = var.storage_replication
  min_tls_version          = "TLS1_2"

  # Enable hierarchical namespace for better performance (optional, uncomment for Premium)
  # is_hns_enabled = false

  tags = var.tags
}

# GitLab storage containers — native Azure Blob (provider: AzureRM)
# No S3 shim required: GitLab CE Helm chart supports Azure Blob natively
resource "azurerm_storage_container" "gitlab_artifacts" {
  name                  = "gitlab-artifacts"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

resource "azurerm_storage_container" "gitlab_uploads" {
  name                  = "gitlab-uploads"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

resource "azurerm_storage_container" "gitlab_packages" {
  name                  = "gitlab-packages"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

resource "azurerm_storage_container" "gitlab_lfs" {
  name                  = "gitlab-lfs"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

resource "azurerm_storage_container" "gitlab_registry" {
  name                  = "gitlab-registry"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

resource "azurerm_storage_container" "gitlab_backups" {
  name                  = "gitlab-backups"
  storage_account_id    = azurerm_storage_account.main.id
  container_access_type = "private"
}

# ─── Entra ID Identity Provider for Keycloak ─────────────────────────
#
# Keycloak federates with Entra ID — users authenticate via "Sign in with
# Microsoft" through Keycloak, which remains the single OIDC issuer for all
# services. This keeps the auth layer portable across clouds (UpCloud, GCP, AWS).
#
# Three App Roles are defined (devops-admins, developers, viewers). Assign
# Entra ID users or security groups to these roles in the Azure portal or
# via the azuread_app_role_assignment resource.
#
# The redirect URI is set to a placeholder here; setup-keycloak.sh updates it
# to the real domain (https://keycloak.<domain>/realms/devops/broker/entra/endpoint)
# using `az ad app update` after the domain is known.

resource "azuread_application" "keycloak_idp" {
  display_name = "${var.prefix}-keycloak-idp"

  web {
    redirect_uris = ["https://placeholder.invalid/realms/devops/broker/entra/endpoint"]
  }

  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
    resource_access {
      id   = "37f7f235-527c-4136-accd-4a02d197296e" # openid
      type = "Scope"
    }
    resource_access {
      id   = "64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0" # email
      type = "Scope"
    }
    resource_access {
      id   = "14dad69e-099b-42c9-810b-d002981feec1" # profile
      type = "Scope"
    }
  }

  # App Roles map to Keycloak groups via setup-keycloak.sh IdP mappers.
  # Assign Entra ID users/groups to these roles in the Azure portal.
  app_role {
    allowed_member_types = ["User"]
    description          = "Full access to DevOps platform administration"
    display_name         = "DevOps Admins"
    enabled              = true
    id                   = "a1b2c3d4-0001-4000-8000-devopsadmins0" # stable GUID
    value                = "devops-admins"
  }

  app_role {
    allowed_member_types = ["User"]
    description          = "Developer access to DevOps platform services"
    display_name         = "Developers"
    enabled              = true
    id                   = "a1b2c3d4-0002-4000-8000-developers000" # stable GUID
    value                = "developers"
  }

  app_role {
    allowed_member_types = ["User"]
    description          = "Read-only access to DevOps platform services"
    display_name         = "Viewers"
    enabled              = true
    id                   = "a1b2c3d4-0003-4000-8000-viewers000000" # stable GUID
    value                = "viewers"
  }
}

resource "azuread_service_principal" "keycloak_idp" {
  client_id                    = azuread_application.keycloak_idp.client_id
  app_role_assignment_required = var.entra_require_assignment
}

resource "azuread_application_password" "keycloak_idp" {
  application_id = azuread_application.keycloak_idp.id
  display_name   = "keycloak-idp-secret"
  end_date       = "2099-01-01T00:00:00Z"
}

# ─── Workload Identity for GitLab ─────────────────────────────────────
#
# Allows GitLab pods (webservice, sidekiq) to access Blob Storage without
# a storage account key. The K8s service account "gitlab" in the "gitlab"
# namespace exchanges its projected OIDC token for an Azure AD token.
#
# AKS must have oidc_issuer_enabled and workload_identity_enabled (set above).

resource "azurerm_user_assigned_identity" "gitlab" {
  name                = "${var.prefix}-gitlab-identity"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  tags                = var.tags
}

# Grant the identity read/write access to all blob containers in the storage account
resource "azurerm_role_assignment" "gitlab_storage" {
  scope                = azurerm_storage_account.main.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.gitlab.principal_id
}

# Federated credential: trusts tokens from the AKS OIDC issuer for the
# "gitlab" service account in the "gitlab" namespace.
# The GitLab Helm chart creates this SA when global.serviceAccount.enabled=true.
resource "azurerm_federated_identity_credential" "gitlab" {
  name                = "${var.prefix}-gitlab-fedcred"
  resource_group_name = azurerm_resource_group.main.name
  parent_id           = azurerm_user_assigned_identity.gitlab.id
  audience            = ["api://AzureADTokenExchange"]
  issuer              = azurerm_kubernetes_cluster.main.oidc_issuer_url
  subject             = "system:serviceaccount:gitlab:gitlab"
}

# ─── External-DNS Workload Identity ──────────────────────────────────
# Allows external-dns to manage Azure DNS records for the cluster's domain.
# The K8s service account "external-dns/external-dns" uses the federated credential.

data "azurerm_dns_zone" "main" {
  name                = var.domain
  resource_group_name = var.dns_zone_resource_group != "" ? var.dns_zone_resource_group : azurerm_resource_group.main.name
}

resource "azurerm_user_assigned_identity" "external_dns" {
  name                = "${var.prefix}-external-dns-identity"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  tags                = var.tags
}

resource "azurerm_role_assignment" "external_dns_dns_contributor" {
  scope                = data.azurerm_dns_zone.main.id
  role_definition_name = "DNS Zone Contributor"
  principal_id         = azurerm_user_assigned_identity.external_dns.principal_id
}

resource "azurerm_federated_identity_credential" "external_dns" {
  name                = "${var.prefix}-external-dns-fedcred"
  resource_group_name = azurerm_resource_group.main.name
  parent_id           = azurerm_user_assigned_identity.external_dns.id
  audience            = ["api://AzureADTokenExchange"]
  issuer              = azurerm_kubernetes_cluster.main.oidc_issuer_url
  subject             = "system:serviceaccount:external-dns:external-dns"
}