locals {
  common_labels = merge({ managed_by = "terraform", workload = var.name }, var.labels)
  services = toset([
    "run.googleapis.com", "pubsub.googleapis.com", "storage.googleapis.com",
    "firestore.googleapis.com", "artifactregistry.googleapis.com",
    "logging.googleapis.com", "monitoring.googleapis.com", "vpcaccess.googleapis.com"
  ])
}

resource "google_project_service" "apis" {
  for_each           = local.services
  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_compute_network" "app" {
  name                    = "${var.name}-vpc"
  auto_create_subnetworks = false
  depends_on              = [google_project_service.apis]
}

resource "google_compute_subnetwork" "app" {
  name          = "${var.name}-subnet"
  ip_cidr_range = "10.10.0.0/24"
  region        = var.region
  network       = google_compute_network.app.id
}

resource "google_vpc_access_connector" "app" {
  name          = substr("${var.name}-connector", 0, 24)
  region        = var.region
  network       = google_compute_network.app.name
  ip_cidr_range = "10.8.0.0/28"
  depends_on    = [google_project_service.apis]
}

resource "google_service_account" "runtime" {
  account_id   = substr("${var.name}-runtime", 0, 30)
  display_name = "${var.name} runtime identity"
}

resource "google_storage_bucket" "objects" {
  name                        = "${var.project_id}-${var.name}-objects"
  location                    = var.region
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"
  labels                      = local.common_labels
  lifecycle_rule {
    condition { age = 365 }
    action { type = "Delete" }
  }
  depends_on = [google_project_service.apis]
}

resource "google_firestore_database" "app" {
  project     = var.project_id
  name        = "(default)"
  location_id = var.region
  type        = "FIRESTORE_NATIVE"
}

resource "google_pubsub_topic" "events" {
  name   = "${var.name}-events"
  labels = local.common_labels
}

resource "google_pubsub_topic" "dead_letter" {
  name   = "${var.name}-events-dead-letter"
  labels = local.common_labels
}

resource "google_artifact_registry_repository" "containers" {
  location      = var.region
  repository_id = var.name
  format        = "DOCKER"
  labels        = local.common_labels
}

resource "google_cloud_run_v2_service" "app" {
  name     = var.name
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"
  labels   = local.common_labels
  template {
    service_account = google_service_account.runtime.email
    scaling { max_instance_count = 20 }
    vpc_access {
      connector = google_vpc_access_connector.app.id
      egress    = "PRIVATE_RANGES_ONLY"
    }
    containers {
      image = var.container_image
      ports { container_port = 8080 }
      resources { limits = { cpu = "1", memory = "512Mi" } }
    }
  }
  depends_on = [google_project_service.apis]
}

resource "google_cloud_run_v2_service_iam_member" "public_invoker" {
  name     = google_cloud_run_v2_service.app.name
  location = var.region
  role     = "roles/run.invoker"
  member   = "allUsers"
}