terraform {
  required_version = ">= 1.6.0, < 2.0.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

resource "google_project_service" "services" {
  for_each = toset([
    "artifactregistry.googleapis.com",
    "logging.googleapis.com",
    "monitoring.googleapis.com",
    "pubsub.googleapis.com",
    "run.googleapis.com",
    "storage.googleapis.com",
  ])
  project            = var.project_id
  service            = each.value
  disable_on_destroy = false
}

resource "google_service_account" "runtime" {
  account_id   = "event-runtime"
  display_name = "Event runtime identity"
  depends_on   = [google_project_service.services]
}

resource "google_storage_bucket" "raw_events" {
  name                        = "${var.project_id}-${var.environment}-raw-events"
  location                    = var.region
  storage_class               = "STANDARD"
  uniform_bucket_level_access = true
  force_destroy               = false
  retention_policy { retention_period = var.retention_seconds }
  lifecycle_rule {
    condition { age = var.retention_days }
    action { type = "Delete" }
  }
  versioning { enabled = true }
  depends_on = [google_project_service.services]
}

resource "google_pubsub_topic" "events" {
  name       = "${var.environment}-events"
  depends_on = [google_project_service.services]
}

resource "google_pubsub_subscription" "events" {
  name                       = "${var.environment}-event-worker"
  topic                      = google_pubsub_topic.events.id
  ack_deadline_seconds       = 60
  message_retention_duration = "604800s"
  retry_policy {
    minimum_backoff = "10s"
    maximum_backoff = "600s"
  }
}

resource "google_artifact_registry_repository" "containers" {
  location      = var.region
  repository_id = "${var.environment}-containers"
  format        = "DOCKER"
  depends_on    = [google_project_service.services]
}

resource "google_cloud_run_v2_service" "ingress" {
  name     = "${var.environment}-event-ingress"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_ALL"
  template {
    service_account = google_service_account.runtime.email
    scaling { max_instance_count = var.max_instances }
    containers {
      image = var.container_image
      env { name = "EVENT_TOPIC" value = google_pubsub_topic.events.id }
      env { name = "RAW_BUCKET" value = google_storage_bucket.raw_events.name }
    }
  }
  depends_on = [google_project_service.services]
}

resource "google_cloud_run_v2_service_iam_member" "ingress_invoker" {
  name     = google_cloud_run_v2_service.ingress.name
  location = google_cloud_run_v2_service.ingress.location
  role     = "roles/run.invoker"
  member   = "serviceAccount:${var.invoker_service_account}"
}