locals {
  wireguard_version = "1.0.20210914-r4-ls54"
  wireguard_config = try(templatefile("${path.module}/resources/wireguard/wireguard.conf.tpl", {
    wireguard_private_key    = var.wireguard_config.private_key
    wireguard_public_key     = var.wireguard_config.public_key
    wireguard_pre_shared_key = var.wireguard_config.pre_shared_key
    wireguard_address        = var.wireguard_config.address
    wireguard_dns            = var.wireguard_config.dns
    wireguard_allowed_ips    = join(", ", var.wireguard_config.allowed_ips)
    wireguard_endpoint       = "${var.wireguard_config.endpoint}:${var.wireguard_config.endpoint_port}"
  }), "null")
  wireguard_config_checksum = nonsensitive(sha256(local.wireguard_config))

  default_headers = {
    "Host" : "$host",
    "X-Real-IP" : "$remote_addr",
    "X-Forwarded-For" : "$proxy_add_x_forwarded_for",
    "X-Forwarded-Proto" : "$scheme",
    "X-Forwarded-Host" : "$host",
    "X-Forwarded-Port" : "$server_port",
  }
  nginx_config          = file("${path.module}/resources/nginx/nginx.conf")
  nginx_config_checksum = sha256(local.nginx_config)

  services_config = {
    for k, v in var.services : "${k}.conf" => coalesce(v.config, templatefile("${path.module}/resources/nginx/conf.d/default.conf.tpl", {
      http_port  = v.http_port
      https_port = v.https_port
      upstream   = v.upstream
      tls        = v.tls
      fqdn       = join(" ", v.fqdn)
      auth       = length([for l in v.locations : true if l.private]) > 0
      locations = [for l in v.locations : {
        path     = l.path
        headers  = merge(l.headers, coalesce(v.default_headers, local.default_headers))
        private  = l.private
        upstream = l.upstream
        rewrite  = l.rewrite
      }]
      custom_snippet = v.custom_snippet
    }))
  }
  services_config_checksum = sha256(jsonencode(local.services_config))

  auth_script          = file("${path.module}/resources/auth/auth_server.py")
  auth_script_checksum = sha256(local.auth_script)
}