terraform {
  required_version = ">= 1.6.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "required" {
  for_each = toset([
    "run.googleapis.com",
    "pubsub.googleapis.com",
    "sqladmin.googleapis.com",
    "secretmanager.googleapis.com",
    "artifactregistry.googleapis.com",
    "vpcaccess.googleapis.com",
  ])
  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_compute_network" "app" {
  name                    = "${var.name}-network"
  auto_create_subnetworks = false
}

resource "google_vpc_access_connector" "app" {
  name          = "${var.name}-vpc"
  region        = var.region
  network       = google_compute_network.app.name
  ip_cidr_range = var.connector_cidr
  depends_on    = [google_project_service.required]
}

resource "google_sql_database_instance" "orders" {
  name             = "${var.name}-postgres"
  database_version = "POSTGRES_15"
  region           = var.region
  settings {
    tier              = var.sql_tier
    availability_type = "ZONAL"
    ip_configuration { ipv4_enabled = false }
    backup_configuration { enabled = true }
  }
  deletion_protection = false
  depends_on           = [google_project_service.required]
}

resource "google_sql_database" "orders" {
  name     = "orders"
  instance = google_sql_database_instance.orders.name
}

resource "google_sql_user" "orders" {
  name     = var.db_user
  instance = google_sql_database_instance.orders.name
  password = var.db_password
}

resource "google_pubsub_topic" "orders" {
  name = "${var.name}-orders"
}

resource "google_pubsub_topic" "dead_letter" {
  name = "${var.name}-orders-dead-letter"
}

resource "google_pubsub_subscription" "worker" {
  name  = "${var.name}-worker"
  topic = google_pubsub_topic.orders.name
  dead_letter_policy { dead_letter_topic = google_pubsub_topic.dead_letter.id max_delivery_attempts = 5 }
  ack_deadline_seconds = 60
}

resource "google_service_account" "runtime" {
  account_id   = "${var.name}-runtime"
  display_name = "Order service runtime identity"
}

resource "google_project_iam_member" "publisher" {
  project = var.project_id
  role    = "roles/pubsub.publisher"
  member  = "serviceAccount:${google_service_account.runtime.email}"
}

resource "google_secret_manager_secret" "db_password" {
  secret_id = "${var.name}-db-password"
  replication { auto {} }
}

resource "google_secret_manager_secret_version" "db_password" {
  secret      = google_secret_manager_secret.db_password.id
  secret_data = var.db_password
}

resource "google_cloud_run_v2_service" "api" {
  name     = "${var.name}-api"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"
  template {
    service_account = google_service_account.runtime.email
    scaling { max_instance_count = var.api_max_instances }
    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
    containers { image = var.api_image env { name = "ORDERS_TOPIC" value = google_pubsub_topic.orders.id } }
  }
  depends_on = [google_project_service.required]
}

resource "google_cloud_run_v2_service" "worker" {
  name     = "${var.name}-worker"
  location = var.region
  template {
    service_account = google_service_account.runtime.email
    scaling { max_instance_count = var.worker_max_instances }
    vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
    containers { image = var.worker_image }
  }
  depends_on = [google_project_service.required]
}