resource "kubernetes_namespace" "proxy" {
  metadata {
    annotations = {
      name = "proxy"
    }

    labels = {
      name = "proxy"
    }

    name = "proxy"
  }
}

resource "kubernetes_service_account" "service_account" {

  metadata {
    name      = "proxy-app-sa"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_service" "services" {
  for_each = var.services
  metadata {
    name      = format("%s", replace(each.key, ".", "-"))
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }
  spec {
    port {
      name        = "http"
      port        = each.value.service_http_port
      target_port = substr(format("http-%s", replace(each.key, ".", "-")), 0, 15)
    }
    dynamic "port" {
      for_each = each.value.tls ? [1] : []
      content {
        name        = "https"
        port        = each.value.service_https_port
        target_port = substr(format("https-%s", replace(each.key, ".", "-")), 0, 15)
      }
    }
    selector = {
      app = "proxy"
    }

    type = "ClusterIP"
  }
}

resource "kubernetes_service" "streams" {
  for_each = var.streams
  metadata {
    name      = substr(format("stream-%s", replace(each.key, ".", "-")), 0, 15)
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }
  spec {
    port {
      name        = substr(format("stream-%s", replace(each.key, ".", "-")), 0, 15)
      port        = each.value.port
      target_port = substr(format("stream-%s", replace(each.key, ".", "-")), 0, 15)
    }
    selector = {
      app = "proxy"
    }

    type = "ClusterIP"
  }
}


resource "kubernetes_manifest" "internal_cert" {

  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "internal-cert"
      namespace = kubernetes_namespace.proxy.metadata[0].name
    }
    spec = {
      secretName = "internal-cert"
      issuerRef = {
        name = var.issuer_name
        kind = "ClusterIssuer"
      }
      commonName = "proxy.internal"
      dnsNames   = flatten([for _, v in var.services : v.fqdn if v.tls == true])
    }
  }
}

resource "kubernetes_config_map" "wireguard_config" {
  count = local.wireguard_config != "null" ? 1 : 0
  metadata {
    name      = "wireguard-config"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = {
    "wireguard.conf" = local.wireguard_config
  }
}

resource "kubernetes_config_map" "nginx_config" {
  metadata {
    name      = "nginx-config"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = {
    "nginx.conf" = local.nginx_config
  }
}

resource "kubernetes_config_map" "nginx_default_config" {
  metadata {
    name      = "nginx-default-config"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = local.services_config
}

resource "kubernetes_config_map" "nginx_streams_config" {
  metadata {
    name      = "nginx-streams-config"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = local.streams_config
}

resource "kubernetes_config_map" "nginx_custom_50x_page" {

  metadata {
    name      = "nginx-errors"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = {
    for k, v in local.errors_pages : k => v
  }

}

resource "kubernetes_config_map" "auth_script" {
  metadata {
    name      = "auth-script"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = {
    "auth_server.py" = local.auth_script
  }
}

resource "kubernetes_ingress_v1" "ingress" {
  for_each = { for k, v in var.services : k => v if lookup(v, "ingress", true) && length(v.fqdn) > 0 }
  metadata {
    name      = format("%s", replace(each.key, ".", "-"))
    namespace = kubernetes_namespace.proxy.metadata[0].name

    annotations = merge({
      "kubernetes.io/ingress.class"    = "public"
      "cert-manager.io/cluster-issuer" = "letsencrypt-prod"
      },
      each.value.custom_ingress_annotations,
      each.value.tls ? {
        "nginx.org/ssl-services"                       = format("%s", replace(each.key, ".", "-"))
        "nginx.org/ssl-redirect"                       = "true"
        "nginx.org/redirect-to-https"                  = "true"
        "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
      } : {}
    )
  }
  spec {
    tls {
      hosts       = each.value.fqdn
      secret_name = format("proxy-%s-tls", replace(each.key, ".", "-"))
    }
    dynamic "rule" {
      for_each = each.value.fqdn
      content {
        host = rule.value
        http {
          path {
            backend {
              service {
                name = format("%s", replace(each.key, ".", "-"))
                port {
                  name = each.value.tls ? "https" : "http"
                }
              }
            }
          }
        }
      }
    }
  }
}

resource "kubernetes_secret" "auth_token" {
  count = var.auth_token != "" ? 1 : 0
  metadata {
    name      = "auth-token-secret"
    namespace = kubernetes_namespace.proxy.metadata[0].name
  }

  data = {
    token = var.auth_token
  }

  type = "Opaque"
}

resource "kubernetes_deployment" "proxy" {

  metadata {
    name      = "proxy"
    namespace = kubernetes_namespace.proxy.metadata[0].name

    annotations = {
      "security.alpha.kubernetes.io/unsafe-sysctls" = "net.ipv4.conf.all.src_valid_mark=1"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "proxy"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app = "proxy"
        }
        annotations = {
          "checksum/nginx"       = local.nginx_config_checksum
          "checksum/services"    = local.services_config_checksum
          "checksum/wireguard"   = local.wireguard_config_checksum
          "checksum/auth_server" = local.auth_script_checksum
          "checksum/custom_50x"  = local.errors_pages_checksum
          "checksum/streams"     = local.streams_config_checksum
        }
      }
      spec {
        dynamic "container" {
          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
          content {

            name  = "wireguard"
            image = "linuxserver/wireguard:${local.wireguard_version}"

            resources {
              requests = {
                memory = "64Mi"
              }
            }

            liveness_probe {
              exec {
                command = [
                  "/bin/sh",
                  "-c",
                  "wg show | grep -q transfer"
                ]
              }
              initial_delay_seconds = 90
              period_seconds        = 90
            }

            security_context {
              privileged = true
              capabilities {
                add = ["NET_ADMIN"]
              }
              read_only_root_filesystem = true
            }

            env {
              name  = "PUID"
              value = "1000"
            }

            env {
              name  = "PGID"
              value = "1000"
            }

            env {
              name  = "TZ"
              value = "Europe/Berlin"
            }

            volume_mount {
              name       = "wireguard-config"
              mount_path = "/config/wg_confs"
              read_only  = true
            }

            volume_mount {
              name       = "lib-modules"
              mount_path = "/lib/modules"
              read_only  = true
            }

            volume_mount {
              name       = "wireguard-run"
              mount_path = "/run"
            }
          }
        }

        dynamic "container" {
          for_each = nonsensitive(var.auth_token) != "" ? [1] : []
          content {
            name  = "auth-sidecar"
            image = "python:3.11-slim"

            command = ["python", "/app/auth_server.py"]

            env {
              name = "AUTH_TOKEN"
              value_from {
                secret_key_ref {
                  name = kubernetes_secret.auth_token[0].metadata[0].name
                  key  = "token"
                }
              }
            }

            volume_mount {
              name       = "auth-script"
              mount_path = "/app"
              read_only  = true
            }

            port {
              container_port = 5000
              name           = "auth"
            }

            security_context {
              read_only_root_filesystem  = true
              run_as_group               = 1000
              run_as_user                = 1000
              allow_privilege_escalation = false
              run_as_non_root            = true
            }
          }
        }

        container {
          name              = "proxy"
          image             = "nginx:${var.tag}"
          image_pull_policy = "Always"

          resources {
            requests = {
              memory = "100Mi"
            }
          }

          security_context {
            allow_privilege_escalation = false
            read_only_root_filesystem  = true
          }

          readiness_probe {
            http_get {
              path = "/health"
              port = 8888
            }
            initial_delay_seconds = 5
            period_seconds        = 10
          }

          liveness_probe {
            http_get {
              path = "/health"
              port = 8888
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            failure_threshold     = 10
            timeout_seconds       = 5
            success_threshold     = 1
          }

          dynamic "port" {
            for_each = { for k, v in var.services : k => v.http_port }
            content {
              container_port = port.value
              name           = substr(format("http-%s", replace(port.key, ".", "-")), 0, 15)
            }
          }

          dynamic "port" {
            for_each = { for k, v in var.services : k => v.https_port if v.tls }
            content {
              container_port = port.value
              name           = substr(format("https-%s", replace(port.key, ".", "-")), 0, 15)
            }
          }

          dynamic "port" {
            for_each = var.streams
            content {
              container_port = port.value.port
              name           = substr(format("stream-%s", replace(port.key, ".", "-")), 0, 15)
              host_port      = port.value.host_port
              protocol       = upper(port.value.protocol)
            }
          }
          volume_mount {
            name       = "nginx"
            mount_path = "/etc/nginx/nginx.conf"
            sub_path   = "nginx.conf"
            read_only  = true
          }
          volume_mount {
            name       = "services"
            mount_path = "/etc/nginx/conf.d/"
            read_only  = true
          }
          volume_mount {
            name       = "streams"
            mount_path = "/etc/nginx/streams.d/"
            read_only  = true
          }
          volume_mount {
            name       = "nginx-errors"
            mount_path = "/usr/share/nginx/html/errors"
            read_only  = true
          }
          volume_mount {
            name       = "nginx-tmp"
            mount_path = "/tmp"
          }
          dynamic "volume_mount" {
            for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
            content {
              name       = "tls"
              mount_path = "/etc/ssl/certs/private"
              read_only  = true
            }
          }
        }

        dynamic "volume" {
          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
          content {
            name = "wireguard-config"
            config_map {
              name = nonsensitive(kubernetes_config_map.wireguard_config[0].metadata[0].name)
            }
          }
        }

        dynamic "volume" {
          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
          content {
            name = "lib-modules"
            host_path {
              path = "/lib/modules"
            }
          }
        }

        dynamic "volume" {
          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
          content {
            name = "wireguard-run"
            empty_dir {
              medium = "Memory"
            }
          }
        }

        volume {
          name = "auth-script"
          config_map {
            name = kubernetes_config_map.auth_script.metadata[0].name
          }
        }

        volume {
          name = "nginx"
          config_map {
            name = kubernetes_config_map.nginx_config.metadata[0].name
          }
        }

        volume {
          name = "services"
          config_map {
            name = kubernetes_config_map.nginx_default_config.metadata[0].name
          }
        }

        volume {
          name = "streams"
          config_map {
            name = kubernetes_config_map.nginx_streams_config.metadata[0].name
          }
        }

        volume {
          name = "nginx-errors"
          config_map {
            name = kubernetes_config_map.nginx_custom_50x_page.metadata[0].name
          }
        }

        volume {
          name = "nginx-tmp"
          empty_dir {
          }
        }

        dynamic "volume" {
          for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
          content {
            name = "tls"
            secret {
              secret_name = kubernetes_manifest.internal_cert.manifest["metadata"]["name"]
              items {
                key  = "tls.crt"
                path = "tls.crt"
              }
              items {
                key  = "tls.key"
                path = "tls.key"
              }
            }
          }
        }

      }
    }
  }

  lifecycle {
    ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
  }
}
