locals {
  wireguard_version = "1.0.20210914-r4-ls54"
  wireguard_config = try(templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
    wireguard_private_key    = var.wireguard_config.private_key
    wireguard_public_key     = var.wireguard_config.public_key
    wireguard_pre_shared_key = var.wireguard_config.pre_shared_key
    wireguard_address        = var.wireguard_config.address
    wireguard_dns            = var.wireguard_config.dns
    wireguard_allowed_ips    = join(", ", var.wireguard_config.allowed_ips)
    wireguard_endpoint       = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}"
  }), "null")
  wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))

  default_headers = {
    "Host" : "$host",
    "X-Real-IP" : "$remote_addr",
    "X-Forwarded-For" : "$proxy_add_x_forwarded_for",
    "X-Forwarded-Proto" : "$scheme",
    "X-Forwarded-Host" : "$host",
    "X-Forwarded-Port" : "$server_port",
  }
  nginx_config          = file("${path.module}/resources/nginx/nginx.conf")
  nginx_config_checksum = sha256(local.nginx_config)

  services_config = {
    for k, v in var.services : "${k}.conf" => coalesce(v.config, templatefile("${path.module}/resources/nginx/conf.d/default.conf.tpl", {
      errors             = local.error_codes
      http_port          = v.http_port
      https_port         = v.https_port
      upstream           = v.upstream
      resolver           = v.resolver
      ingress            = v.ingress
      service_http_port  = v.service_http_port
      service_https_port = v.service_https_port
      tls                = v.tls
      fqdn               = length(v.fqdn) > 0 ? join(" ", v.fqdn) : k
      auth               = length([for l in v.locations : true if l.private]) > 0
      locations = [for l in v.locations : {
        path     = l.path
        headers  = merge(l.headers, coalesce(v.default_headers, local.default_headers))
        private  = l.private
        upstream = l.upstream
        resolver = l.resolver
        rewrite  = l.rewrite
      }]
      custom_snippet = v.custom_snippet
    }))
  }
  services_config_checksum = sha256(jsonencode(local.services_config))

  streams_config = {
    for k, v in var.streams : "${k}.conf" => templatefile("${path.module}/resources/nginx/streams.d/stream.conf.tpl", {
      name           = k
      port           = v.port
      upstream       = v.upstream
      custom_snippet = v.custom_snippet
      upstream_port  = coalesce(v.upstream_port, v.port)
      resolver       = v.resolver
      protocol       = upper(v.protocol)
    })
  }
  streams_config_checksum = sha256(jsonencode(local.streams_config))

  auth_script          = file("${path.module}/resources/auth/auth_server.py")
  auth_script_checksum = sha256(local.auth_script)

  error_codes = [for f in fileset("${path.module}/resources/errors", "*.html") : split(".", f)[0]]
  errors_pages = {
    for f in local.error_codes :
    "${f}.html" => file("${path.module}/resources/errors/${f}.html")
  }
  errors_pages_checksum = sha256(jsonencode(local.errors_pages))
}