# -----------------------------------------------------------------------------
# OCI CIS Agent — OKE Deployment Stack
# Load Balancer: Self-Signed TLS, HTTPS/HTTP Listeners, Backend Set
# -----------------------------------------------------------------------------

# --- Self-Signed TLS Certificate ---

resource "tls_private_key" "lb" {
  algorithm = "RSA"
  rsa_bits  = 2048
}

resource "tls_self_signed_cert" "lb" {
  private_key_pem = tls_private_key.lb.private_key_pem

  subject {
    common_name  = var.domain_name != "" ? var.domain_name : "oci-cis-agent.local"
    organization = "OCI CIS Agent"
  }

  validity_period_hours = 8760 # 1 year
  is_ca_certificate     = false

  allowed_uses = [
    "key_encipherment",
    "digital_signature",
    "server_auth",
  ]
}

# --- Load Balancer ---

resource "oci_load_balancer_load_balancer" "main" {
  compartment_id = var.compartment_ocid
  display_name   = "cisagent-oke-lb"
  shape          = "flexible"

  shape_details {
    minimum_bandwidth_in_mbps = var.lb_min_bandwidth_mbps
    maximum_bandwidth_in_mbps = var.lb_max_bandwidth_mbps
  }

  subnet_ids = [oci_core_subnet.public.id]

  is_private = false

  freeform_tags = var.freeform_tags
}

# --- Certificate ---

resource "oci_load_balancer_certificate" "main" {
  load_balancer_id   = oci_load_balancer_load_balancer.main.id
  certificate_name   = "cisagent-self-signed"
  public_certificate = tls_self_signed_cert.lb.cert_pem
  private_key        = tls_private_key.lb.private_key_pem

  lifecycle {
    create_before_destroy = true
  }
}

# --- Backend Set ---
# Backends point to worker node IPs on the fixed NodePort.
# The K8s Service must use spec.type=NodePort with nodePort=30080.

resource "oci_load_balancer_backend_set" "app" {
  load_balancer_id = oci_load_balancer_load_balancer.main.id
  name             = "cisagent-backend-set"
  policy           = "ROUND_ROBIN"

  health_checker {
    protocol          = "HTTP"
    port              = var.node_port
    url_path          = "/api/health"
    return_code       = 200
    interval_ms       = 10000
    timeout_in_millis = 5000
    retries           = 3
  }
}

# --- Backends (one per worker node) ---
# Uses node private IPs from the node pool data source.

resource "oci_load_balancer_backend" "nodes" {
  for_each = {
    for idx, node in data.oci_containerengine_node_pool.app.nodes :
    idx => node
    if node.state == "ACTIVE"
  }

  load_balancer_id = oci_load_balancer_load_balancer.main.id
  backendset_name  = oci_load_balancer_backend_set.app.name
  ip_address       = each.value.private_ip
  port             = var.node_port
  weight           = 1
}

# --- HTTPS Listener (443) ---

resource "oci_load_balancer_listener" "https" {
  load_balancer_id         = oci_load_balancer_load_balancer.main.id
  name                     = "cisagent-https"
  default_backend_set_name = oci_load_balancer_backend_set.app.name
  port                     = 443
  protocol                 = "HTTP"

  ssl_configuration {
    certificate_name        = oci_load_balancer_certificate.main.certificate_name
    verify_peer_certificate = false
    protocols               = ["TLSv1.2", "TLSv1.3"]
  }
}

# --- HTTP Listener (80) with redirect to HTTPS ---

resource "oci_load_balancer_listener" "http_redirect" {
  load_balancer_id         = oci_load_balancer_load_balancer.main.id
  name                     = "cisagent-http-redirect"
  default_backend_set_name = oci_load_balancer_backend_set.app.name
  port                     = 80
  protocol                 = "HTTP"
  rule_set_names           = [oci_load_balancer_rule_set.http_redirect.name]

  connection_configuration {
    idle_timeout_in_seconds = 60
  }
}

# --- Rule Set: HTTP to HTTPS Redirect ---

resource "oci_load_balancer_rule_set" "http_redirect" {
  load_balancer_id = oci_load_balancer_load_balancer.main.id
  name             = "http-to-https-redirect"

  items {
    action      = "REDIRECT"
    description = "Redirect HTTP to HTTPS"

    conditions {
      attribute_name  = "PATH"
      attribute_value = "/"
      operator        = "FORCE_LONGEST_PREFIX_MATCH"
    }

    redirect_uri {
      protocol = "HTTPS"
      port     = 443
      host     = "{host}"
      path     = "/{path}"
      query    = "?{query}"
    }

    response_code = 301
  }
}