terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 6.0" }
  }
}

resource "aws_security_group" "endpoint" {
  name_prefix = "xet-privatelink-"
  description = "Xet upload endpoints"
  vpc_id      = var.vpc_id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = var.client_cidr_blocks
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = var.tags
}

# --- hf CLI upload path -----------------------------------------------------

# Created in pendingAcceptance. We accept by hand, so this blocks until we do.
resource "aws_vpc_endpoint" "cas" {
  count = var.cas_service_name == null ? 0 : 1

  vpc_id              = var.vpc_id
  service_name        = var.cas_service_name
  service_region      = var.service_region
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.subnet_ids
  security_group_ids  = [aws_security_group.endpoint.id]
  private_dns_enabled = false

  timeouts {
    create = "30m"
  }

  tags = var.tags
}

resource "aws_route53_zone" "xethub" {
  count = var.cas_service_name == null ? 0 : 1

  name = "xethub.hf.co"

  vpc {
    vpc_id = var.vpc_id
  }

  tags = var.tags
}

resource "aws_route53_record" "cas_server" {
  count = var.cas_service_name == null ? 0 : 1

  zone_id = aws_route53_zone.xethub[0].zone_id
  name    = "cas-server.xethub.hf.co"
  type    = "CNAME"
  ttl     = 60
  records = [aws_vpc_endpoint.cas[0].dns_entry[0].dns_name]
}

# --- S3 API path ------------------------------------------------------------

resource "aws_vpc_endpoint" "s3_gateway" {
  count = var.s3_service_name == null ? 0 : 1

  vpc_id              = var.vpc_id
  service_name        = var.s3_service_name
  service_region      = var.service_region
  vpc_endpoint_type   = "Interface"
  subnet_ids          = coalesce(var.s3_subnet_ids, var.subnet_ids)
  security_group_ids  = [aws_security_group.endpoint.id]
  private_dns_enabled = false

  timeouts {
    create = "30m"
  }

  tags = var.tags
}

resource "aws_route53_zone" "s3" {
  count = var.s3_service_name == null ? 0 : 1

  name = "s3.hf.co"

  vpc {
    vpc_id = var.vpc_id
  }

  tags = var.tags
}

# s3.hf.co is the zone apex, where a CNAME is not allowed. Alias instead.
resource "aws_route53_record" "s3" {
  count = var.s3_service_name == null ? 0 : 1

  zone_id = aws_route53_zone.s3[0].zone_id
  name    = "s3.hf.co"
  type    = "A"

  alias {
    name                   = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].dns_name
    zone_id                = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].hosted_zone_id
    evaluate_target_health = false
  }
}