resource "random_password" "db_master" {
  length  = 32
  special = false
}

data "aws_rds_engine_version" "postgres" {
  engine  = "postgres"
  version = var.db_engine_version
  latest  = true
}

resource "aws_db_subnet_group" "main" {
  name       = "${local.name_prefix}-db"
  subnet_ids = [for s in aws_subnet.private : s.id]
  tags       = { Name = "${local.name_prefix}-db-subnets" }
}

resource "aws_db_instance" "main" {
  identifier              = "${local.name_prefix}-db"
  engine                  = "postgres"
  engine_version          = data.aws_rds_engine_version.postgres.version_actual
  instance_class          = var.db_instance_class
  allocated_storage       = var.db_allocated_storage
  storage_type            = "gp3"
  storage_encrypted       = true
  db_name                 = "aries_datalake"
  username                = "aries"
  password                = random_password.db_master.result
  db_subnet_group_name    = aws_db_subnet_group.main.name
  vpc_security_group_ids  = [aws_security_group.database.id]
  publicly_accessible     = false
  multi_az                = false
  backup_retention_period = 7
  skip_final_snapshot     = var.environment != "prod"
  deletion_protection     = var.environment == "prod"
  apply_immediately       = var.environment != "prod"

  tags = { Name = "${local.name_prefix}-db" }
}

locals {
  database_url = "postgresql://aries:${random_password.db_master.result}@${aws_db_instance.main.address}:5432/aries_datalake?sslmode=require&uselibpqcompat=true"
}

resource "aws_secretsmanager_secret" "database_url" {
  name                    = "${local.name_prefix}/database-url"
  description             = "Postgres connection string for the Aries datalake control plane"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "database_url" {
  secret_id     = aws_secretsmanager_secret.database_url.id
  secret_string = local.database_url
}

resource "random_password" "token_signing_secret" {
  length  = 64
  special = false
}

resource "aws_secretsmanager_secret" "token_signing" {
  name                    = "${local.name_prefix}/token-signing-secret"
  description             = "HMAC signing secret shared between the control and data planes"
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "token_signing" {
  secret_id     = aws_secretsmanager_secret.token_signing.id
  secret_string = random_password.token_signing_secret.result
}