variable "kubernetes_input" {
  type = map(object({
    name   = optional(string)
    docker = optional(bool)
    image  = string
    pvc = optional(map(object({
      name                 = optional(string)
      config_map           = optional(bool, false)
      secret               = optional(bool, false)
      local_path           = optional(bool, false)
      host_path            = optional(string)
      storage_class_name   = optional(string, "nfs-storage-intelligent")
      annotations_fileType = optional(string)
      mount_path           = string
      sub_path             = optional(string)
    })))
    environment = optional(map(object({
      name  = optional(string)
      value = optional(string)
      value_from = optional(object({
        secret_key_ref = object({
          name = string
          key  = optional(string, null)
        })
      }))
    })))
    replicas               = optional(number, 1)
    namespace              = optional(string)
    connected_namespace    = optional(string, "")
    command                = optional(list(string))
    service_port           = optional(list(number))
    external_port          = optional(bool, false)
    service_type           = optional(string, "ClusterIP")
    service_name           = optional(string)
    domain_name            = optional(string)
    legacy_domain          = optional(bool, false)
    exposed                = optional(bool, true)
    liveness_tcp_socket    = optional(number)
    liveness_http_get      = optional(string)
    liveness_http_get_path = optional(string)
    database               = optional(map(string))
    database_command       = optional(list(string))
    database_args          = optional(list(string))
    redis                  = optional(map(string))
    enabled                = optional(bool, true)
    secret_ref             = optional(list(string))
    config_map_ref         = optional(list(string))
    config_map_import      = optional(list(string))
    secret_import          = optional(list(string))
    extra_manifest         = optional(list(string))
    requirements           = optional(map(string))
    dns_nameservers        = optional(string)
    service_account_name   = optional(string)
    environment_variables  = optional(map(string), { name = "value" })
    security_context       = optional(bool, false)
  }))

}


resource "kubernetes_ingress_v1" "automatic_ingress" {
  # Keep your top-level filter for filtering active services
  for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }

  metadata {
    name      = "${each.key}-ingress"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)

    annotations = {
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
    }
  }

  spec {
    ingress_class_name = "traefik"

    # --- DYNAMIC TLS BLOCK ---
    # Generates a separate TLS block + secret per domain entry
    dynamic "tls" {
      for_each = toset(coalesce(each.value.domain_name, [each.key]))
      content {
        hosts       = [join(".", [tls.value, "geeraert.eu"])]
        secret_name = "${each.key}-${tls.value}-tls-secret"
      }
    }

    # --- DYNAMIC RULE BLOCK ---
    # Loops through the domain list and creates an HTTP path routing rule for each
    dynamic "rule" {
      for_each = toset(coalesce(each.value.domain_name, [each.key]))
      content {
        host = join(".", [rule.value, "geeraert.eu"])
        http {
          path {
            path = "/"
            backend {
              service {
                name = "${each.key}-svc"
                port {
                  number = each.value.service_port[0]
                }
              }
            }
          }
        }
      }
    }

  }
}

resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
  # Keep your top-level filter for filtering active services
  for_each = { for key, value in var.kubernetes_input : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }

  metadata {
    name      = "${each.key}-ingress"
    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)

    annotations = {
      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
    }
  }

  spec {
    ingress_class_name = "traefik"

    # --- DYNAMIC TLS BLOCK ---
    # Generates a separate TLS block + secret per domain entry
    dynamic "tls" {
      for_each = toset(coalesce(each.value.domain_name, [each.key]))
      content {
        hosts       = [join(".", [tls.value, "geeraert.eu"])]
        secret_name = "${each.key}-${tls.value}-tls-secret"
      }
    }

    # --- DYNAMIC RULE BLOCK ---
    # Loops through the domain list and creates an HTTP path routing rule for each
    dynamic "rule" {
      for_each = toset(coalesce(each.value.domain_name, [each.key]))
      content {
        host = join(".", [rule.value, "geeraert.eu"])
        http {
          path {
            path = "/"
            backend {
              service {
                name = "${each.key}-svc"
                port {
                  number = each.value.service_port[0]
                }
              }
            }
          }
        }
      }
    }

  }
}