module.alb.tf

locals {
  world_access = "0.0.0.0/0"
}

data "terraform_remote_state" "global" {
  backend = "s3"

  config = {
    bucket = "br-ops-terraform"
    key    = "tf-aws-core-infra/global/terraform.tfstate"
    region = "us-east-1"
  }
}


# Public ALB

resource "aws_lb" "public" {
  name            = "${var.cluster_name}-${var.service_name}-public"
  internal        = false
  security_groups = [aws_security_group.public.id]
  subnets         = var.public_subnet_ids

  access_logs {
    bucket  = data.terraform_remote_state.global.outputs.lb_logs_ue1_bucket
    prefix  = "${var.cluster_name}-${var.service_name}-alb-public"
    enabled = var.enable_alb_logs
  }

  tags = {
    public_lb    = true
    service_name = var.service_name
    terraform    = true
    clustername  = var.cluster_name
    ecs          = true
    env          = var.env
  }
}

resource "aws_alb_listener" "http_public_redirect" {
  load_balancer_arn = aws_lb.public.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_alb_listener" "https_public" {
  load_balancer_arn = aws_lb.public.arn
  port              = "443"
  protocol          = "HTTPS"
  certificate_arn   = var.alb_listener_certificate_arn

  default_action {
    type = "fixed-response"

    fixed_response {
      content_type = "text/plain"
      message_body = "Not found."
      status_code  = "404"
    }
  }
}

resource "aws_alb_listener" "http_private_redirect" {
  load_balancer_arn = aws_lb.private.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_alb_listener" "https_private" {
  load_balancer_arn = aws_lb.private.arn
  port              = "443"
  protocol          = "HTTPS"
  certificate_arn   = var.alb_listener_certificate_arn

  default_action {
    type = "fixed-response"

    fixed_response {
      content_type = "text/plain"
      message_body = "Not found."
      status_code  = "404"
    }
  }
}

resource "aws_security_group" "public" {
  name   = "${var.cluster_name}-${var.service_name}-alb-public-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = [local.world_access]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = [local.world_access]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = [local.world_access]
  }

  tags = {
    terraform   = true
    clustername = var.cluster_name
    public_lb   = true
    ecs         = true
  }
}

# Private ALB

resource "aws_lb" "private" {
  name            = "${var.cluster_name}-${var.service_name}-private"
  internal        = true
  security_groups = [aws_security_group.private.id]
  subnets         = var.private_subnet_ids

  access_logs {
    bucket  = data.terraform_remote_state.global.outputs.lb_logs_ue1_bucket
    prefix  = "${var.cluster_name}-alb-private"
    enabled = var.enable_alb_logs
  }

  tags = {
    terraform    = true
    env          = var.env
    service_name = var.service_name
    clustername  = var.cluster_name
    ecs          = true
  }
}

resource "aws_security_group" "private" {
  name   = "${var.cluster_name}-${var.service_name}-alb-private-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "6"
    cidr_blocks = [var.vpc_global_cidr]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "6"
    cidr_blocks = [var.vpc_global_cidr]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  lifecycle {
    create_before_destroy = true
  }

  tags = {
    terraform   = true
    clustername = var.cluster_name
  }
}

outputs.tf

output "alb_data" {
  value = {
    "public" = {
      "http_listener_arn"  = coalescelist(aws_alb_listener.http_public_redirect[*].arn, ["none"])[0]
      "https_listener_arn" = aws_alb_listener.https_public.arn
      "dns"                = aws_lb.public.dns_name
    }
    "private" = {
      "http_listener_arn"  = coalescelist(aws_alb_listener.http_private_redirect[*].arn, ["none"])[0]
      "https_listener_arn" = aws_alb_listener.https_private.arn
      "dns"                = aws_lb.private.dns_name
    }
  }
}