terraform {
  required_version = ">= 1.6.0, < 2.0.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "services" {
  for_each = toset([
    "run.googleapis.com", "sqladmin.googleapis.com", "pubsub.googleapis.com",
    "artifactregistry.googleapis.com", "secretmanager.googleapis.com",
    "logging.googleapis.com", "monitoring.googleapis.com", "cloudtrace.googleapis.com"
  ])
  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_artifact_registry_repository" "images" {
  location      = var.region
  repository_id = "${var.name}-images"
  format        = "DOCKER"
  depends_on    = [google_project_service.services]
}

resource "google_sql_database_instance" "primary" {
  name             = "${var.name}-sql"
  database_version = "POSTGRES_15"
  region           = var.region
  settings {
    tier              = var.sql_tier
    availability_type = var.sql_ha ? "REGIONAL" : "ZONAL"
    disk_type         = "PD_SSD"
    disk_autoresize   = true
    backup_configuration { enabled = true }
    ip_configuration { ipv4_enabled = true }
  }
  deletion_protection = var.deletion_protection
  depends_on          = [google_project_service.services]
}

resource "google_sql_database" "app" {
  name     = var.name
  instance = google_sql_database_instance.primary.name
}

resource "google_pubsub_topic" "events" { name = "${var.name}-events" }
resource "google_pubsub_topic" "dead_letter" { name = "${var.name}-dead-letter" }

resource "google_pubsub_subscription" "worker" {
  name  = "${var.name}-worker"
  topic = google_pubsub_topic.events.name
  dead_letter_policy {
    dead_letter_topic     = google_pubsub_topic.dead_letter.id
    max_delivery_attempts = 10
  }
  ack_deadline_seconds = 30
}

resource "google_secret_manager_secret" "database_url" {
  secret_id = "${var.name}-database-url"
  replication { auto {} }
  depends_on = [google_project_service.services]
}

resource "google_service_account" "runtime" {
  account_id   = "${var.name}-runtime"
  display_name = "${var.name} runtime identity"
}

resource "google_project_iam_member" "runtime_log_writer" {
  project = var.project_id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.runtime.email}"
}

resource "google_cloud_run_v2_service" "api" {
  name     = "${var.name}-api"
  location = var.region
  template {
    service_account = google_service_account.runtime.email
    containers {
      image = var.api_image
      env { name = "PUBSUB_TOPIC" value = google_pubsub_topic.events.name }
      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
    }
  }
  depends_on = [google_project_service.services]
}

resource "google_cloud_run_v2_service" "worker" {
  name     = "${var.name}-worker"
  location = var.region
  template {
    service_account = google_service_account.runtime.email
    containers {
      image = var.worker_image
      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
    }
  }
  depends_on = [google_project_service.services]
}