resource "aws_cloudfront_distribution" "distribution" {

  enabled = true

  viewer_certificate {
    cloudfront_default_certificate = true
  }
  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
  origin {
    domain_name = aws_s3_bucket.frontend_bucket.bucket_regional_domain_name
    origin_id   = "s3" # ID
  }

  origin {
    domain_name = replace(aws_api_gateway_deployment.hailmeoout-api-deployment.invoke_url, "/^https?://([^/]*).*/", "$1")
    origin_id   = "apigw" # ID

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "s3" # Use the s3 origin

    # Don't forward query string or cookies
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
  }

  ordered_cache_behavior {
    path_pattern     = "/api/*"
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "apigw" # Use the apigw origin

    # Disable caching
    default_ttl = 0
    min_ttl     = 0
    max_ttl     = 0

    # Forward everything
    forwarded_values {
      query_string = true
      cookies {
        forward = "all"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
  }
}

output "frontend_url" {
  value = aws_cloudfront_distribution.distribution.domain_name
}