locals {
  # cidr_blocks = "${concat(data.aws_subnet.private.*.cidr_block, formatlist("%s/32", list(data.aws_ssm_parameter.bastion_ip.value, data.aws_ssm_parameter.mopintgw_ip.value)))}"
  cidr_blocks = concat(data.terraform_remote_state.mop_core.outputs.vpc_subnets_private_cidr_blocks, formatlist("%s/32", [data.terraform_remote_state.mop_core.outputs.bastion_ip]))
}

resource "aws_security_group" "billing_service_https" {
  name = "${var.service_name}-https"
  description = "HTTPS access to ${var.service_name}"
  vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
  tags = {
    Name = "${var.service_name}-https"
  }

  // allow traffic for TCP 443,18443/tcp from SG (self)
  ingress {
    from_port = 443
    to_port = 443
    protocol = "tcp"
  }
  ingress {
    from_port = 18443
    to_port = 18443
    protocol = "tcp"
  }

  // allow traffic for 443,18443/tcp from authorized IPv4
  ingress {
    from_port = 443
    to_port = 443
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }
  ingress {
    from_port = 18443
    to_port = 18443
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}

// Security Group Resource for Module
resource "aws_security_group" "billing_service_alb" {
  name        = "${var.service_name}-alb"
  description = "ALB access to the ${var.service_name}"
  vpc_id      = data.terraform_remote_state.mop_core.outputs.vpc_id
  tags = {
    Name = "${var.service_name}-alb"
  }

  // allows traffic from the SG itself for tcp
  ingress {
    from_port = 0
    to_port   = 65535
    protocol  = "tcp"
    self      = true
  }

  // allows traffic from the SG itself for udp
  ingress {
    from_port = 0
    to_port   = 65535
    protocol  = "udp"
    self      = true
  }

  ingress {
    from_port = 0
    to_port   = 65535
    protocol  = "tcp"
    security_groups = [
      data.terraform_remote_state.mop_core.outputs.sg_http_private_id,
      data.terraform_remote_state.mop_core.outputs.sg_alb_id
    ]
  }

  // allows traffic from the SG itself for udp
  ingress {
    from_port = 0
    to_port   = 65535
    protocol  = "udp"
    security_groups = [
      data.terraform_remote_state.mop_core.outputs.sg_http_private_id,
      data.terraform_remote_state.mop_core.outputs.sg_alb_id
    ]
  }
  // allow all outbound
  egress {
    from_port   = 0
    to_port     = 65535
    protocol    = "udp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

}

## need to import legacy mysql group to add below
#data "aws_security_group" "tf_mysql_sg" {
#  id = "${data.aws_ssm_parameter.legacy_mysql_sg_id}"
#}

resource "aws_security_group" "billing_service_mysql" {
  name = "${var.service_name}-mysql"
  description = "Security Group ${var.service_name}-mysql"
  vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
    
  tags = {
    Name = "${var.service_name}-mysql"
  }

    // NOTE: I am pretty sure 
    // allows traffic from the SG itself for tcp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    self = true
  }

    // allows traffic from the SG itself for udp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    self = true
  }

  // allows traffic from the legacy SG
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }

  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }


  // allow traffic for TCP 22
  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  // allow traffic for TCP 3306
  ingress {
    from_port = 3306
    to_port = 3306
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }

}