terraform {
  required_version = "> 0.8.0"
  required_providers {
    bitwarden = {
      source  = "maxlaverse/bitwarden"
      version = ">= 0.13.6"
    }
  }
}

provider "kubernetes" {
  config_path = "~/.kube/config"
}

provider "bitwarden" {
  email           = "pierre@geeraert.eu"
  master_password = ""
  server          = "https://bitwarden.tryton.geeraert.eu"
  experimental {
    embedded_client = true
  }
}
#https://stackoverflow.com/questions/66670949/how-to-tell-terraform-to-skip-the-secret-manager-resource-if-it-exists
#for the secret not overwritten (not tested)
data "bitwarden_item_login" "example" {
  search = "bookstack.zeus.geeraert.eu"
}

data "bitwarden_item_secure_note" "vpn_preshared_key" {
  search = "terraform testing"
}
output "pgpin" {
  value     = nonsensitive(coalesce(data.bitwarden_item_secure_note.vpn_preshared_key.field.1.hidden,1234))
  sensitive = true
}

resource "random_password" "password" {
  length           = 16
  special          = true
  override_special = "!#$%&*()-_=+[]{}<>:?"
}

resource "bitwarden_item_secure_note" "terraform_upload_testing" {
  name            = "terraform upload testing"
#  notes           = <<EOT
#[global]
#secret = "<something sensitive>"
#EOT
  organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
  collection_ids  = ["3fa902cd-8244-46bc-a4ea-af8901262d94"]

  field {
    name = "category"
    hidden = random_password.password.result
  }
}

variable "kubernetes" {
  type = map(object({
    name  = optional(string)
    image = string
    pvc = optional(map(object({
      name               = string
      pvc                = optional(bool, false)
      config_map         = optional(bool, false)
      host_path          = optional(string)
      pvc_size           = optional(string)
      storage_class_name = optional(string, "nfs-storage-intelligent")
      mount_path         = string
    })))
    environment = optional(map(object({
      name  = optional(string)
      value = optional(string)
      value_from = optional(object({
        secret_key_ref = object({
          name = string
          key  = optional(string, null)
        })
      }))
    })))
    replicas            = optional(number, 1)
    namespace           = optional(string)
    connected_namespace = optional(string, "")
    #    namespace           = optional(string,coalesce(connected_namespace,""))
    #block_namespace_creation = optional(bool, false)
    service_port           = optional(list(number))
    service_type           = optional(string, "ClusterIP")
    service_name           = optional(string)
    liveness_tcp_socket    = optional(number)
    liveness_http_get      = optional(string)
    liveness_http_get_path = optional(string)
    database               = optional(map(string))
    redis                  = optional(map(string))
    enabled                = optional(bool, true)
    secret_ref             = optional(list(string))
    config_map_ref         = optional(list(string))
    extra_manifest         = optional(list(string))
    requirements           = optional(map(string))
    #    requirements = optional(map(string), {
    #      limits-cpu      = "800m"
    #      limits-memory   = "500Mi"
    #      requests-cpu    = "200m"
    #      requests-memory = "200Mi"
    #    })
    dns_nameservers       = optional(string)
    environment_variables = optional(map(string), { name = "value" })
    security_context      = optional(bool, false)
  }))

}

locals {
  pvc_details = flatten([
    for key, value in var.kubernetes : [
      for index, pvc in value.pvc : {
        index              = index
        pvc                = pvc.pvc
        name               = pvc.name
        pvc_size           = pvc.pvc_size
        mount_path         = pvc.mount_path
        storage_class_name = pvc.storage_class_name
        namespace          = coalesce(value.namespace, value.connected_namespace, key)
    }] if value.enabled == true && value.pvc != null
  ])
}

locals {
  env_details = flatten([
    for key, value in var.kubernetes : [
      for index, env in value.environment_variables : {
        index = index
        name  = env
    }] if value.enabled == true && value.environment_variables != null
  ])
}


data "kubernetes_all_namespaces" "allns" {}

resource "kubernetes_namespace" "automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
  metadata {
    annotations = {
      name = coalesce(each.value.namespace, each.key)
    }
    labels = {
      deployment_method = "Terraform"
    }
    name = coalesce(each.value.namespace, each.key)
  }
  depends_on = [data.kubernetes_all_namespaces.allns]
}

locals {
  kubernetes_manifests = flatten([
    for k, obj in var.kubernetes : [
      for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
      {
        key      = "${k}_${index}"
        name     = obj.name
        manifest = manifest
        enabled  = obj.enabled
      }
      if obj.enabled == true
    ]
  ])
}

resource "kubernetes_manifest" "manifest" {
  for_each = { for item in local.kubernetes_manifests : item.key => item }

  manifest = yamldecode(file(each.value.manifest))
  provider = kubernetes
}



resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc }
  metadata {
    namespace = coalesce(each.value.namespace, each.key)
    name      = "${each.value.name}-pvc"
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = each.value.storage_class_name
    resources {
      requests = {
        storage = each.value.pvc_size
      }
    }
  }
}
resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${each.key}-db-pvc"
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = "nfs-storage-intelligent"
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${each.key}-redis-pvc"
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    access_modes       = ["ReadWriteMany"]
    storage_class_name = "nfs-storage-intelligent"
    resources {
      requests = {
        storage = "1Gi"
      }
    }
  }
}

resource "kubernetes_service" "automatic_service" {
  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
  metadata {
    name      = "${each.key}-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
    annotations = each.value.service_type == "LoadBalancer" ? {
      "metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
    } : {}



  }
  spec {
    selector = {
      app = each.key
    }
    dynamic "port" {
      for_each = each.value.service_port != null ? each.value.service_port : []
      content {
        port        = port.value
        target_port = port.value
        name        = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")

      }
    }

    #    port {
    #      port        = each.value.service_port
    #      target_port = each.value.service_port
    #    }
    type = each.value.service_type


  }


}

resource "kubernetes_service" "automatic_service_database" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
  metadata {
    name      = "${each.key}-db-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    selector = {
      app = "${each.key}-db"
    }
    port {
      port        = try(each.value.database.port, 5432)
      target_port = try(each.value.database.port, 5432)
    }

  }


}



resource "kubernetes_service" "automatic_service_redis" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
  metadata {
    name      = "${each.key}-redis-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
  }
  spec {
    selector = {
      app = "${each.key}-redis"
    }
    port {
      port        = 6379
      target_port = 6379
    }
  }
}



resource "kubernetes_deployment_v1" "automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = coalesce(each.value.name, each.key)

    labels = {
      app               = each.key
      deployment_method = "Terraform"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = each.key
      }
    }

    template {
      metadata {
        labels = {
          app               = each.key
          deployment_method = "Terraform"
        }
      }

      spec {
        container {
          image = each.value.image
          name  = coalesce(each.value.name, each.key)
          dynamic "port" {
            for_each = each.value.service_port != null ? each.value.service_port : []
            content {
              container_port = port.value
              #              name           = "${each.key}-${port.value}"
              name = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")
            }
          }


          dynamic "volume_mount" {
            for_each = each.value.pvc != null ? each.value.pvc : {}
            content {
              mount_path = volume_mount.value.mount_path
              name       = "${volume_mount.value.name}-pvc"
            }
          }


          dynamic "env_from" {
            for_each = each.value.secret_ref != null ? each.value.secret_ref : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }
          dynamic "env_from" {
            for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
            content {
              dynamic "config_map_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }


          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                      #                      optional = true
                    }
                  }
                }
              }

            }
          }
          dynamic "resources" {
            for_each = each.value.requirements != null ? [1] : []
            content {
              limits = {
                cpu    = each.value.requirements.limits-cpu
                memory = each.value.requirements.limits-memory
              }
              requests = {
                cpu    = each.value.requirements.requests-cpu
                memory = each.value.requirements.requests-memory
              }

            }
          }

          #          resources {
          #            limits = {
          #              cpu    = each.value.requirements.limits-cpu
          #              memory = each.value.requirements.limits-memory
          #            }
          #            requests = {
          #              cpu    = each.value.requirements.requests-cpu
          #              memory = each.value.requirements.requests-memory
          #            }
          #          }

          dynamic "security_context" {
            for_each = each.value.security_context == true ? [1] : []
            content {
              privileged = true
              #capabilities = {
              #  add : ["NET_ADMIN", "NET_RAW"]
              #}
            }
          }
          dynamic "liveness_probe" {
            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
            content {
              dynamic "tcp_socket" {
                for_each = each.value.liveness_tcp_socket != null ? [""] : []
                content {
                  port = each.value.liveness_tcp_socket
                }
              }

              dynamic "http_get" {
                for_each = each.value.liveness_http_get != null ? [""] : []
                content {
                  port = each.value.liveness_http_get
                  path = coalesce(each.value.liveness_http_get_path, "/")
                }
              }

              initial_delay_seconds = 3
              period_seconds        = 3
            }
          }
        }
        dynamic "dns_config" {
          for_each = each.value.dns_nameservers != null ? [1] : []
          content {
            nameservers = [each.value.dns_nameservers]
          }

        }

        dynamic "volume" {
          for_each = each.value.pvc != null ? each.value.pvc : {}
          content {
            name = "${volume.value.name}-pvc"

            dynamic "persistent_volume_claim" {
              for_each = volume.value.pvc ? [1] : []
              content {
                claim_name = "${volume.value.name}-pvc"
              }
            }

            dynamic "config_map" {
              for_each = volume.value.config_map ? [1] : []
              content {
                name = volume.value.name
              }
            }

            dynamic "host_path" {
              for_each = volume.value.host_path != null ? [1] : []
              content {
                path = volume.value.host_path
              }
            }


          }
        }

      }
    }
  }
}



resource "kubernetes_deployment_v1" "database-automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }


  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${coalesce(each.value.namespace, each.key)}-db"
    labels = {
      app               = each.key
      deployment_method = "Terraform"
      database          = "true"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = "${each.key}-db"
      }
    }

    template {
      metadata {
        labels = {
          app               = "${each.key}-db"
          deployment_method = "Terraform"
          database          = "true"
        }
      }

      spec {
        container {
          image = try(each.value.database.image, "docker.io/library/postgres:latest")
          name  = "${coalesce(each.value.name, each.key)}-db"
          port {

            container_port = 5432
            name           = "database-port"

          }

          volume_mount {
            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/data")
            name       = "${each.key}-db-pvc"
          }





          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                      #                     optional = true
                    }
                  }
                }
              }

            }
          }


          #          resources {
          #            limits = {
          #              cpu    = each.value.requirements.limits-cpu
          #              memory = each.value.requirements.limits-memory
          #            }
          #            requests = {
          #              cpu    = each.value.requirements.requests-cpu
          #              memory = each.value.requirements.requests-memory
          #            }
          #          }

          #          dynamic "liveness_probe" {
          #            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
          #           content {
          #              dynamic "tcp_socket" {
          #                for_each = each.value.liveness_tcp_socket != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_tcp_socket
          #                }
          #              }


          #              dynamic "http_get" {
          #                for_each = each.value.liveness_http_get != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_http_get
          #                  path = coalesce(each.value.liveness_http_get_path, "/")
          #                }
          #              }

          #              initial_delay_seconds = 3
          #              period_seconds        = 3
          #            }
          #          }
        }


        volume {
          name = "${each.key}-db-pvc"
          persistent_volume_claim {
            claim_name = "${each.key}-db-pvc"
          }
        }

      }
    }
  }
}


resource "kubernetes_deployment_v1" "redis-automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }


  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = "${coalesce(each.value.namespace, each.key)}-redis"
    labels = {
      app               = each.key
      deployment_method = "Terraform"
      redis             = "true"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = "${each.key}-redis"
      }
    }

    template {
      metadata {
        labels = {
          app               = "${each.key}-redis"
          deployment_method = "Terraform"
          redis             = "true"
        }
      }

      spec {
        container {
          image = try(each.value.redis.image, "docker.io/library/redis:7")
          name  = "${coalesce(each.value.name, each.key)}-redis"
          port {

            container_port = 6379
            name           = "redis-port"

          }

          volume_mount {
            mount_path = "/data"
            name       = "${each.key}-redis-pvc"
          }





          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                      #                    optional = true
                    }
                  }
                }
              }

            }
          }


          #          resources {
          #            limits = {
          #              cpu    = each.value.requirements.limits-cpu
          #              memory = each.value.requirements.limits-memory
          #            }
          #            requests = {
          #              cpu    = each.value.requirements.requests-cpu
          #              memory = each.value.requirements.requests-memory
          #            }
          #          }

          #          dynamic "liveness_probe" {
          #            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
          #           content {
          #              dynamic "tcp_socket" {
          #                for_each = each.value.liveness_tcp_socket != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_tcp_socket
          #                }
          #              }


          #              dynamic "http_get" {
          #                for_each = each.value.liveness_http_get != null ? [""] : []
          #                content {
          #                  port = each.value.liveness_http_get
          #                  path = coalesce(each.value.liveness_http_get_path, "/")
          #                }
          #              }

          #              initial_delay_seconds = 3
          #              period_seconds        = 3
          #            }
          #          }
        }


        volume {
          name = "${each.key}-redis-pvc"
          persistent_volume_claim {
            claim_name = "${each.key}-redis-pvc"
          }
        }

      }
    }
  }
}