locals {
  name = "atlantis"

  tags = {
     ...
  }

  default_autoplan_file_list = [
    "**/*.tf",
    "**/*.tfvars",
    "**/*.tfvars.json",
    "**/terragrunt.hcl",
    "**/.terraform.lock.hcl",
  ]

  atlantis_autoplan_file_list = compact(
    concat(
      local.default_autoplan_file_list,
      # negate the paths
      formatlist("!%s", var.atlantis_excluded_projects)
    )
  )
}

##############################################################
# Data sources for existing resources
##############################################################

data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

data "aws_ssm_parameter" "github_app_key" {
  name = "/atlantis/github/app/key"
}

data "aws_ssm_parameter" "github_app_webhook" {
  name = "/atlantis/github/app/webhook"
}

data "aws_ssm_parameter" "infracost_token" {
  name = "/infracost/user/token"
}

data "aws_ssm_parameter" "okta_secret" {
  name = "/okta/client/secret"
}

data "aws_ssm_parameter" "humio_ingest_token" {
  name = "/humio/atlantis/token"
}

data "aws_secretsmanager_secret" "dockerhub" {
  name = "/dockerhub/user/token"
}

data "aws_vpc" "this" {
  id = var.vpc_id
}

data "aws_route53_zone" "this" {
  name = var.domain
}

##############################################################
# Atlantis
##############################################################

module "atlantis" {
  source  = "terraform-aws-modules/atlantis/aws"
  version = "~> 4"

  name = local.name

  # ECS
  atlantis = {
    image = var.atlantis_image
    environment = concat(
      [
        {
          name : "ATLANTIS_ENABLE_DIFF_MARKDOWN_FORMAT",
          value : "true"
        },
        {
          name : "ATLANTIS_AUTOPLAN_MODULES",
          value : "true"
        },
        {
          name : "ATLANTIS_AUTOPLAN_FILE_LIST",
          value : join(",", local.atlantis_autoplan_file_list),
        },
        {
          name : "ATLANTIS_PARALLEL_POOL_SIZE",
          value : "20"
        },
        {
          name : "ATLANTIS_PARALLEL_PLAN",
          value : "true"
        },
        {
          name : "ATLANTIS_REPO_CONFIG_JSON",
          value : jsonencode(yamldecode(file("${path.module}/server-atlantis.yaml"))),
        },
        # semi-hardcode host & port to avoid circular dependencies -- redis
        # module requires security group id created by `atlantis` module.
        {
          name : "ATLANTIS_REDIS_HOST",
          value : "atlantis-${var.env}-redis.elasticache-redis.local"
        },
        {
          name : "ATLANTIS_REDIS_PORT",
          value : "6379"
        },
        {
          name : "ATLANTIS_REDIS_TLS_ENABLED",
          value : "false"
        },
        {
          name : "ATLANTIS_REDIS_INSECURE_SKIP_VERIFY",
          value : "false"
        },
        # access is granted based on iam role.
        {
          name : "ATLANTIS_REDIS_PASSWORD",
          value : ""
        },
        {
          name : "ATLANTIS_LOCKING_DB_TYPE",
          value : "redis"
        },
        {
          name : "ATLANTIS_GH_ALLOW_MERGEABLE_BYPASS_APPLY",
          value : "true"
        },
        {
          name : "ATLANTIS_GH_APP_INSTALLATION_ID",
          value : var.atlantis_github_app_installation_id
        },
        {
          name : "ATLANTIS_GH_APP_SLUG",
          value : var.atlantis_github_app_slug
        },
        {
          name : "TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE",
          value : "true"
        },
        {
          name : "ATLANTIS_CHECKOUT_STRATEGY",
          value : "merge"
        },
        {
          name : "ATLANTIS_AUTOMERGE",
          value : "true"
        },
        {
          name : "ATLANTIS_ALLOW_COMMANDS",
          value : "all"
        },
        {
          name  = "ATLANTIS_REPO_ALLOWLIST"
          value = join(",", [for repo in var.github_repo_names : "<http://github.com/${var.github_organization}/${repo}|github.com/${var.github_organization}/${repo}>"])
        },
        {
          name = "ATLANTIS_HIDE_PREV_PLAN_COMMENTS"
          value : "true"
        },
        {
          name : "ATLANTIS_LOG_LEVEL",
          value : "debug"
        },
        {
          name : "ATLANTIS_GH_APP_ID",
          value : var.atlantis_github_app_id
        },
        {
          name : "ATLANTIS_WRITE_GIT_CREDS",
          value : "true"
        },
      ]
    )
    secrets = [
      {
        "name" : "INFRACOST_API_KEY",
        "valueFrom" : data.aws_ssm_parameter.infracost_token.name,
      },
      {
        "name" : "ATLANTIS_GH_APP_KEY",
        "valueFrom" : data.aws_ssm_parameter.github_app_key.name,
      },
      {
        "name" : "ATLANTIS_GH_WEBHOOK_SECRET",
        "valueFrom" : data.aws_ssm_parameter.github_app_webhook.name,
      },
    ]
    repository_credentials = {
      credentialsParameter = data.aws_secretsmanager_secret.dockerhub.arn,
    }
    # atlantis task logs are shipped to humio via fluentbit sidecar.
    # `defaultRepoName` can be anything, it's not used, logs are shipped to
    # specific humio repository based on the token used.
    log_configuration = {
      logDriver = "awsfirelens",
      options = {
        "Name" : "es",
        "Host" : "<http://cloud.humio.com|cloud.humio.com>",
        "Port" : "9200",
        "HTTP_User" : "defaultRepoName",
        "Logstash_Format" : "On",
        "Type" : "flb_type",
        "Time_Key" : "@timestamp",
        "Replace_Dots" : "On",
        "Logstash_Prefix" : "atlantis",
        "Buffer_Size" : "5MB",
        "tls" : "On",
      }
      secretOptions = [
        {
          name      = "HTTP_Passwd",
          valueFrom = data.aws_ssm_parameter.humio_ingest_token.name,
        }
      ]
    }
  }

  service = {
    enable_execute_command = true
    runtime_platform = {
      operating_system_family = "LINUX"
      cpu_architecture        = "ARM64"
    }
    memory = 4096
    task_exec_ssm_param_arns = [
      data.aws_ssm_parameter.infracost_token.arn,
      data.aws_ssm_parameter.terraform_cloud_token.arn,
      data.aws_ssm_parameter.github_app_key.arn,
      data.aws_ssm_parameter.github_app_webhook.arn,
      data.aws_ssm_parameter.humio_ingest_token.arn,
    ]
    task_exec_secret_arns = [
      data.aws_secretsmanager_secret.dockerhub.arn,
    ]
    tasks_iam_role_policies = {
      AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
    }
    container_definitions = {
      # fluentbit -- sidecar to ship `atlantis` task logs to humio. fluentbit's
      # own logs are stored in cloudwatch.
      fluentbit = {
        essential          = true
        image              = "amazon/aws-for-fluent-bit:stable"
        memory_reservation = 50
        log_configuration = {
          logDriver = "awslogs",
          options = {
            awslogs-create-group  = "true",
            awslogs-group         = "atlantis-humio",
            awslogs-region        = var.region,
            awslogs-stream-prefix = "humio-ingester",
          }
        }
        firelens_configuration = {
          type = "fluentbit"
          options = {
            enable-ecs-log-metadata = "true",
            config-file-type        = "file",
            config-file-value       = "/fluent-bit/configs/parse-json.conf",
          }
        }
      }
    }
  }

  # ALB
  alb = {
    https_listener = {
      action_type = "authenticate-oidc"
      authenticate_oidc = {
         ...
      }
      rules = {
        # allow github webhooks bypass okta screen.
        noauth-github-ips = {
          priority = 3
          actions = [
            {
              type             = "forward"
              target_group_key = "atlantis"
            }
          ]
          conditions = [
            {
              source_ip = {
                values = [
                  "140.82.112.0/20",
                  "185.199.108.0/22",
                  "192.30.252.0/22",
                  "143.55.64.0/20",
                ]
              }
            }
          ]
        }
        noauth-github-events = {
          priority = 4
          actions = [
            {
              type             = "forward"
              target_group_key = "atlantis"
            }
          ]
          conditions = [
            {
              path_pattern = {
                values = ["/events"]
              }
            }
          ]
        }
        # fixme(opo): metrics should only be accessible from prometheus pub ip in ops.
        # noauth-metrics = {
        #   priority = 4
        #   actions = [
        #     {
        #       type             = "forward"
        #       target_group_key = "atlantis"
        #     }
        #   ]
        #   conditions = [
        #     {
        #       path_pattern = {
        #         values = ["/metrics"]
        #       }
        #     }
        #   ]
        # }
      }
    }
  }

  alb_subnets     = var.public_subnet_ids
  service_subnets = var.private_subnet_ids
  vpc_id          = data.aws_vpc.this.id

  # ACM
  certificate_domain_name = "${local.name}.${var.domain}"
  route53_zone_id         = data.aws_route53_zone.this.id

  tags = local.tags
}