# creating VPC

resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  instance_tenancy     = "default"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name = "${var.project_name}-${var.project_env}"
  }
}

#Creating IGW

resource "aws_internet_gateway" "igw" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "${var.project_name}-${var.project_env}"
  }
}
# Creating subnets

resource "aws_subnet" "public1" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 0)
  availability_zone       = "${var.region}a"
  map_public_ip_on_launch = true
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-public1"

  }

}

resource "aws_subnet" "public2" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 1)
  availability_zone       = "${var.region}b"
  map_public_ip_on_launch = true
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-public2"

  }

}
resource "aws_subnet" "public3" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 2)
  availability_zone       = "${var.region}c"
  map_public_ip_on_launch = true
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-public3"

  }
}
resource "aws_subnet" "private1" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 3)
  availability_zone       = "${var.region}a"
  map_public_ip_on_launch = false
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-private1"

  }
}
resource "aws_subnet" "private2" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 4)
  availability_zone       = "${var.region}b"
  map_public_ip_on_launch = false
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-private2"

  }
}
resource "aws_subnet" "private3" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 3, 5)
  availability_zone       = "${var.region}c"
  map_public_ip_on_launch = false
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-private3"

  }
}

#Creating a data source to find the hosted zone

data "aws_route53_zone" "chris" {
  name         = var.public_domain
  private_zone = false
}

# creating elastic IP for frontend instance

resource "aws_eip" "pub_ip" {
  vpc      = true
  instance = aws_instance.frontend.id
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-frontend"
  }
}

# creating elastic IP for NAT G/W

resource "aws_eip" "ip" {
  vpc = true
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-"
  }
}


# Creating chrisich.fun A record

resource "aws_route53_record" "a" {
  zone_id = data.aws_route53_zone.chris.zone_id
  name    = "${var.frontend_hostname}.${var.public_domain}"
  type    = "A"
  ttl     = 5
  records = [aws_eip.pub_ip.public_ip]
}

# Creating a Private hosted zone

resource "aws_route53_zone" "private" {
  name = var.private_domain

  vpc {
    vpc_id = aws_vpc.main.id
  }
  tags = {
    "Name" = "${var.project_name}-${var.project_env}"
  }
}

# Creating Private hosted Zone records

resource "aws_route53_record" "frontend" {
  zone_id = aws_route53_zone.private.zone_id
  name    = "frontend.${var.private_domain}"
  type    = "A"
  ttl     = 5
  records = [aws_instance.frontend.private_ip]
}

resource "aws_route53_record" "backend" {
  zone_id = aws_route53_zone.private.zone_id
  name    = "backend.${var.private_domain}"
  type    = "A"
  ttl     = 5
  records = [aws_instance.backend.private_ip]
}

resource "aws_route53_record" "bastion" {
  zone_id = aws_route53_zone.private.zone_id
  name    = "bastion.${var.private_domain}"
  type    = "A"
  ttl     = 5
  records = [aws_instance.backend.private_ip]
}



# creating NAT gateway

resource "aws_nat_gateway" "nat" {
  allocation_id = aws_eip.ip.id
  subnet_id     = aws_subnet.public1.id
  tags = {
    "Name" = "${var.project_name}-${var.project_env}"
  }

  depends_on = [aws_internet_gateway.igw]

}

# Creating Route table

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.igw.id
  }
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-public"
  }
}
resource "aws_route_table" "private" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.nat.id
  }
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-private"
  }
}


#Association with the route table

resource "aws_route_table_association" "public1" {
  subnet_id      = aws_subnet.public1.id
  route_table_id = aws_route_table.public.id
}

resource "aws_route_table_association" "public2" {
  subnet_id      = aws_subnet.public2.id
  route_table_id = aws_route_table.public.id
}

resource "aws_route_table_association" "public3" {
  subnet_id      = aws_subnet.public3.id
  route_table_id = aws_route_table.public.id
}
resource "aws_route_table_association" "private1" {
  subnet_id      = aws_subnet.private1.id
  route_table_id = aws_route_table.private.id
}
resource "aws_route_table_association" "private2" {
  subnet_id      = aws_subnet.private2.id
  route_table_id = aws_route_table.private.id
}
resource "aws_route_table_association" "private3" {
  subnet_id      = aws_subnet.private3.id
  route_table_id = aws_route_table.private.id

}

# Creating Security group

resource "aws_security_group" "bastion" {
  name_prefix = "${var.project_name}-${var.project_env}-bastion-"
  description = "Allow ssh from my IP only"
  vpc_id      = aws_vpc.main.id

  ingress {
    description      = "22 from my IP"
    from_port        = 22
    to_port          = 22
    protocol         = "tcp"
    cidr_blocks      = ["103.104.44.48/32"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "${var.project_name}-${var.project_env}-bastion"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "frontend" {
  name_prefix = "${var.project_name}-${var.project_env}-frontend-"
  description = "Allow http,https and ssh"
  vpc_id      = aws_vpc.main.id
  ingress {
    description      = "HTTP port"
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
  ingress {
    description      = "HTTPS port"
    from_port        = 443
    to_port          = 443
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  ingress {
    description      = "22 from my IP"
    from_port        = 22
    to_port          = 22
    protocol         = "tcp"
    security_groups  = [aws_security_group.bastion.id]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "${var.project_name}-${var.project_env}-frontend"
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "backend" {
  name_prefix = "${var.project_name}-${var.project_env}-backend-"
  description = "Allow mysql and ssh port only"
  vpc_id      = aws_vpc.main.id

  ingress {
    description      = "22 from Bastion"
    from_port        = 22
    to_port          = 22
    protocol         = "tcp"
    security_groups  = [aws_security_group.bastion.id]
    ipv6_cidr_blocks = ["::/0"]
  }
  ingress {
    description      = "MYSQL IP"
    from_port        = 3306
    to_port          = 3306
    protocol         = "tcp"
    security_groups  = [aws_security_group.frontend.id]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "${var.project_name}-${var.project_env}-backend"
  }

  lifecycle {
    create_before_destroy = true
  }
}


# Creating a new key pair with TLS provider

resource "tls_private_key" "rsa" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "zomato" {
  key_name   = var.project_name
  public_key = tls_private_key.rsa.public_key_openssh
}

#Downloading in local machine

resource "local_file" "zomato" {
  content  = tls_private_key.rsa.private_key_openssh
  filename = "${var.project_name}.pem"
  file_permission = "400"
}

# Creating ec2-instance

resource "aws_instance" "bastion" {
  ami                    = var.ami
  subnet_id              = aws_subnet.public1.id
  instance_type          = var.instance_type
  key_name               = aws_key_pair.zomato.id
  vpc_security_group_ids = [aws_security_group.bastion.id]
  user_data              = file("bastion.sh")
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-bastion"
  }

}

resource "aws_instance" "frontend" {
  ami                    = var.ami
  subnet_id              = aws_subnet.public2.id
  instance_type          = var.instance_type
  key_name               = aws_key_pair.zomato.id
  vpc_security_group_ids = [aws_security_group.frontend.id]
  user_data              = file("frontend.sh")
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-frontend"
  }
}

resource "aws_instance" "backend" {
  ami                    = var.ami
  subnet_id              = aws_subnet.private1.id
  instance_type          = var.instance_type
  key_name               = aws_key_pair.zomato.id
  vpc_security_group_ids = [aws_security_group.backend.id]
  user_data              = file("backend.sh")
  tags = {
    "Name" = "${var.project_name}-${var.project_env}-backend"
  }

}