# -----------------------------------------------------------------------------
# Self-Signed TLS Certificate (fallback when no domain)
# -----------------------------------------------------------------------------
resource "tls_private_key" "lb" {
  algorithm = "RSA"
  rsa_bits  = 2048
}

resource "tls_self_signed_cert" "lb" {
  private_key_pem = tls_private_key.lb.private_key_pem

  subject {
    common_name  = var.domain_name != "" ? var.domain_name : "cisagent.local"
    organization = "OCI CIS Agent"
  }

  validity_period_hours = 8760 # 1 year

  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
  ]
}

# -----------------------------------------------------------------------------
# Load Balancer
# -----------------------------------------------------------------------------
resource "oci_load_balancer_load_balancer" "main" {
  compartment_id = var.compartment_ocid
  display_name   = "cisagent-lb"
  shape          = "flexible"
  freeform_tags  = var.freeform_tags

  shape_details {
    minimum_bandwidth_in_mbps = var.lb_min_bandwidth_mbps
    maximum_bandwidth_in_mbps = var.lb_max_bandwidth_mbps
  }

  subnet_ids = [oci_core_subnet.public.id]

  is_private = false
}

# -----------------------------------------------------------------------------
# Certificate
# -----------------------------------------------------------------------------
resource "oci_load_balancer_certificate" "self_signed" {
  load_balancer_id   = oci_load_balancer_load_balancer.main.id
  certificate_name   = "cisagent-self-signed"
  public_certificate = tls_self_signed_cert.lb.cert_pem
  private_key        = tls_private_key.lb.private_key_pem

  lifecycle {
    create_before_destroy = true
  }
}

# -----------------------------------------------------------------------------
# Backend Set
# -----------------------------------------------------------------------------
resource "oci_load_balancer_backend_set" "app" {
  load_balancer_id = oci_load_balancer_load_balancer.main.id
  name             = "cisagent-backend-set"
  policy           = "ROUND_ROBIN"

  health_checker {
    protocol            = "HTTP"
    port                = 8080
    url_path            = "/api/health"
    interval_ms         = 10000
    timeout_in_millis   = 5000
    retries             = 3
    return_code         = 200
  }
}

# -----------------------------------------------------------------------------
# Backend
# -----------------------------------------------------------------------------
resource "oci_load_balancer_backend" "app" {
  load_balancer_id = oci_load_balancer_load_balancer.main.id
  backendset_name  = oci_load_balancer_backend_set.app.name
  ip_address       = oci_core_instance.app.private_ip
  port             = 8080
}

# -----------------------------------------------------------------------------
# HTTPS Listener (443)
# -----------------------------------------------------------------------------
resource "oci_load_balancer_listener" "https" {
  load_balancer_id         = oci_load_balancer_load_balancer.main.id
  name                     = "cisagent-https-listener"
  default_backend_set_name = oci_load_balancer_backend_set.app.name
  port                     = 443
  protocol                 = "HTTP"

  ssl_configuration {
    certificate_name        = oci_load_balancer_certificate.self_signed.certificate_name
    verify_peer_certificate = false
    protocols               = ["TLSv1.2", "TLSv1.3"]
  }
}

# -----------------------------------------------------------------------------
# HTTP → HTTPS Redirect Rule Set
# -----------------------------------------------------------------------------
resource "oci_load_balancer_rule_set" "redirect_http_to_https" {
  load_balancer_id = oci_load_balancer_load_balancer.main.id
  name             = "redirect-http-to-https"

  items {
    action = "REDIRECT"

    conditions {
      attribute_name  = "PATH"
      attribute_value = "/"
      operator        = "FORCE_LONGEST_PREFIX_MATCH"
    }

    redirect_uri {
      protocol = "HTTPS"
      port     = 443
      host     = "{host}"
      path     = "/{path}"
      query    = "?{query}"
    }

    response_code = 301
  }
}

# -----------------------------------------------------------------------------
# HTTP Listener (80) with Redirect
# -----------------------------------------------------------------------------
resource "oci_load_balancer_listener" "http" {
  load_balancer_id         = oci_load_balancer_load_balancer.main.id
  name                     = "cisagent-http-listener"
  default_backend_set_name = oci_load_balancer_backend_set.app.name
  port                     = 80
  protocol                 = "HTTP"
  rule_set_names           = [oci_load_balancer_rule_set.redirect_http_to_https.name]
}