terraform {
  required_version = "> 0.8.0"
  backend "http" {
    address        = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy"
    lock_address   = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy/lock"
    unlock_address = "https://gitea.geeraert.eu/api/packages/pi-ux-ce/terraform/state/reverse-proxy/lock"
    lock_method    = "POST"
    unlock_method  = "DELETE"
    username       = "pierre@geeraert.eu"
    password       = "a624d4613a6d35f6093eb5f3d12492c6a7676354"
  }
}

variable "nginx_sites" {
  type = map(object({
    service                 = string
    enabled                 = optional(bool, true)
    proxy_cache             = optional(bool, false)
    extra-value             = optional(string, "")
    extra-value-location    = optional(string, "")
    http2_bool              = optional(bool, false)
    proxy_pass_https        = optional(bool, false)
    authentication_required = optional(bool, false)
    redirect_to_https_bool  = optional(bool, true)
    listen_port_80_bool     = optional(bool, false)
    geoip_blocking          = optional(bool, false)
    geoip_allow             = optional(list(string), ["FR", "GB"])
    redirect_to_root_domain = optional(bool, true)
  }))

}
variable "deny_ip" {
  type = list(string)
}

locals {
  geoip_allow_list = distinct(flatten([
    for key, value in var.nginx_sites : [{
      name         = join("_", sort(value.geoip_allow))
      country_list = sort(value.geoip_allow)
    }] if value.enabled == true && value.geoip_allow != null
  ]))

  geoip_allow_list_test = distinct([
    for key, value in var.nginx_sites : [{
      value = sort(value.geoip_allow)
    }] if value.enabled == true && value.geoip_allow != null
  ])

}


resource "kubernetes_config_map" "deny_ip_configmap" {
  metadata {
    name      = "deny-ip-terraform"
    namespace = "reverse-proxy"
    annotations = {
      "reloader.stakater.com/match" : "true",
    }
  }

  data = {
    "deny.conf" = templatefile("deny_ip.json.tftpl", {
    deny_ip = var.deny_ip })
  }
}

resource "kubernetes_config_map" "websites_configmap" {
  metadata {
    name      = "sites-terraform"
    namespace = "netdata"
  }

  data = {
    "websites.json" = templatefile("httpcheck.yaml.tftpl", {
    map_of_params = var.nginx_sites })
  }
}


resource "kubernetes_config_map" "automatic-configmap" {
  metadata {
    name      = "sites-terraform"
    namespace = "reverse-proxy"
    annotations = {
      "reloader.stakater.com/match" : "true",
    }
  }

  data = {
    for key, value in var.nginx_sites :
    "${key}.conf" => templatefile("nginx_config.tftpl", {
      name_site               = key
      name_service            = value.service
      proxy_cache             = value.proxy_cache
      extra-value             = value.extra-value
      extra-value-location    = value.extra-value-location
      http2_bool              = value.http2_bool
      proxy_pass_https        = value.proxy_pass_https
      authentication_required = value.authentication_required
      redirect_to_https_bool  = value.redirect_to_https_bool
      listen_port_80_bool     = value.listen_port_80_bool
      geoip_blocking          = value.geoip_blocking
      geoip_allow             = value.geoip_allow
    }) if value.enabled == true
  }

}

resource "kubernetes_config_map" "automatic-geoip-allow" {
  metadata {
    name      = "geoip-allow"
    namespace = "reverse-proxy"
    annotations = {
      "reloader.stakater.com/match" : "true",
    }
  }

  data = {
    for key, value in local.geoip_allow_list :
    "${value.name}.conf" => templatefile("geoip.conf.tftpl", {
      name                 = value.name
      allowed_country_list = value.country_list
    })
  }
}



#resource "null_resource" "cluster" {
#  provisioner "local-exec" {
#    command = "kubectl get pods -n reverse-proxy -o name | xargs -I{} kubectl delete  -n reverse-proxy {}"
#  }
#}

#https://github.com/stakater/Reloader


output "Nginx_status" {
  value = "Nginx pod restarted"
}
provider "kubernetes" {
  config_path = "~/.kube/config"
}