resource "kubernetes_service_v1" "automatic_service" {
  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
  metadata {
    name      = "${each.key}-svc"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    labels = {
      deployment_method = "Terraform"
    }
    annotations = each.value.service_type == "LoadBalancer" ? {
      "metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
    } : {}



  }
  spec {
    selector = {
      app = each.key
    }
    dynamic "port" {
      for_each = each.value.service_port != null ? each.value.service_port : []
      content {
        port        = port.value
        target_port = port.value
        name        = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")

      }
    }

    #    port {
    #      port        = each.value.service_port
    #      target_port = each.value.service_port
    #    }
    type = each.value.service_type


  }
  depends_on = [resource.kubernetes_namespace_v1.automatic]


}

resource "kubernetes_ingress_v1" "automatic_ingress" {
  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
  metadata {
    name      = "${each.key}-ingress"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)

    annotations = {
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
    }
  }

  spec {
    ingress_class_name = "traefik"
    # Dynamic TLS configuration for cert-manager
    tls {
      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
      secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
    }

    rule {
      host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
      http {
        path {
          path = "/"
          backend {
            service {
              name = "${each.key}-svc"
              port {
                number = each.value.service_port[0] #selecting the first of the list
              }
            }
          }
        }
      }
    }
  }
}
resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
  metadata {
    name      = "${each.key}-ingress-legacy"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)

    annotations = {
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
    }
  }

  spec {
    ingress_class_name = "traefik"
    # Dynamic TLS configuration for cert-manager
    tls {
      hosts       = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
      secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
    }

    rule {
      host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
      http {
        path {
          path = "/"
          backend {
            service {
              name = "${each.key}-svc"
              port {
                number = each.value.service_port[0] #selecting the first of the list
              }
            }
          }
        }
      }
    }
  }
}


resource "kubernetes_deployment_v1" "automatic" {
  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
  metadata {
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
    name      = coalesce(each.value.name, each.key)

    labels = {
      app               = each.key
      deployment_method = "Terraform"
    }
  }

  spec {
    replicas = each.value.replicas

    selector {
      match_labels = {
        app = each.key
      }
    }

    template {
      metadata {
        labels = {
          app               = each.key
          deployment_method = "Terraform"
        }
      }

      spec {
        container {
          image = each.value.image
          name  = coalesce(each.value.name, each.key)
          dynamic "port" {
            for_each = each.value.service_port != null ? each.value.service_port : []
            content {
              container_port = port.value
              #              name           = "${each.key}-${port.value}"
              name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
            }
          }


          dynamic "volume_mount" {
            for_each = each.value.pvc != null ? each.value.pvc : {}
            content {
              mount_path = volume_mount.value.mount_path
              name       = "${volume_mount.key}-volume"
              sub_path   = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
            }
          }

          dynamic "volume_mount" {
            for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
            content {
              mount_path = "/backup"
              name       = "${each.key}-db-backup"
            }
          }

          dynamic "env_from" {
            for_each = each.value.secret_ref != null ? each.value.secret_ref : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }

            }
          }
          dynamic "env_from" {
            for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
            #for_each = each.value.database != null && each.value.enabled == true  ? ["${each.key}-db-terraform"] : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }
          dynamic "env_from" {
            for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
            content {
              dynamic "secret_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }
          dynamic "env_from" {
            for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
            content {
              dynamic "config_map_ref" {
                for_each = [1]
                content {
                  name = env_from.value
                }
              }
            }
          }

          command = each.value.command != null ? each.value.command : []


          dynamic "env" {
            for_each = each.value.environment != null ? each.value.environment : {}
            content {
              name  = env.key
              value = env.value.value != null ? env.value.value : null
              dynamic "value_from" {
                for_each = env.value.value_from != null ? env.value.value_from : {}
                content {
                  dynamic "secret_key_ref" {
                    for_each = [1]
                    content {
                      name = env.value.value_from.secret_key_ref.name
                      key  = env.value.value_from.secret_key_ref.key
                    }
                  }
                }
              }

            }
          }
          dynamic "resources" {
            for_each = each.value.requirements != null ? [1] : []
            content {
              limits = {
                cpu    = each.value.requirements.limits-cpu
                memory = each.value.requirements.limits-memory
              }
              requests = {
                cpu    = each.value.requirements.requests-cpu
                memory = each.value.requirements.requests-memory
              }

            }
          }


          dynamic "security_context" {
            for_each = each.value.security_context == true ? [1] : []
            content {
              privileged = true
              #capabilities = {
              #  add : ["NET_ADMIN", "NET_RAW"]
              #}
            }
          }
          dynamic "liveness_probe" {
            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
            content {
              dynamic "tcp_socket" {
                for_each = each.value.liveness_tcp_socket != null ? [""] : []
                content {
                  port = each.value.liveness_tcp_socket
                }
              }

              dynamic "http_get" {
                for_each = each.value.liveness_http_get != null ? [""] : []
                content {
                  port = each.value.liveness_http_get
                  path = coalesce(each.value.liveness_http_get_path, "/")
                }
              }

              initial_delay_seconds = 3
              period_seconds        = 3
            }
          }
        }
        dynamic "dns_config" {
          for_each = each.value.dns_nameservers != null ? [1] : []
          content {
            nameservers = [each.value.dns_nameservers]
          }

        }
        service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null

        dynamic "volume" {
          for_each = each.value.pvc != null ? each.value.pvc : {}
          content {
            name = "${volume.key}-volume"

            dynamic "config_map" {
              for_each = volume.value.config_map ? [1] : []
              content {
                name = volume.key
              }
            }

            dynamic "host_path" {
              for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
              content {
                path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))

              }
            }

            dynamic "secret" {
              for_each = volume.value.secret ? [1] : []
              content {
                secret_name = volume.key
              }
            }

          }
        }
        dynamic "volume" {
          for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
          content {
            name = "${each.key}-db-backup"

            host_path {
              path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
            }
          }
        }

      }
    }
  }
}