terraform {
  required_version = ">= 1.6.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 6.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

locals {
  enabled = var.provision
}

resource "google_project_service" "run" {
  count   = local.enabled ? 1 : 0
  project = var.project_id
  service = "run.googleapis.com"
}

resource "google_project_service" "secretmanager" {
  count   = local.enabled ? 1 : 0
  project = var.project_id
  service = "secretmanager.googleapis.com"
}

resource "google_service_account" "workload" {
  count        = local.enabled ? 1 : 0
  account_id   = "gateway-workload"
  display_name = "Least-privilege gateway workload"
}

resource "google_secret_manager_secret_iam_member" "runtime_reader" {
  count     = local.enabled ? 1 : 0
  project   = var.project_id
  secret_id = var.secret_id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${google_service_account.workload[0].email}"
}

resource "google_cloud_run_v2_service" "gateway" {
  count    = local.enabled ? 1 : 0
  name     = "platform-gateway"
  location = var.region
  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"

  template {
    service_account = google_service_account.workload[0].email
    containers {
      image = var.service_image
      env {
        name = "UPSTREAM_MODE"
        value = "platform-proxy"
      }
      env {
        name = "RUNTIME_SECRET"
        value_source {
          secret_key_ref {
            secret  = var.secret_id
            version = "latest"
          }
        }
      }
      resources {
        limits = { cpu = "1", memory = "512Mi" }
      }
    }
    scaling { max_instance_count = 10 }
  }
  depends_on = [google_project_service.run, google_project_service.secretmanager,
    google_secret_manager_secret_iam_member.runtime_reader]
}

resource "google_cloud_run_v2_service_iam_member" "gateway_invoker" {
  count    = local.enabled ? 1 : 0
  name     = google_cloud_run_v2_service.gateway[0].name
  location = var.region
  role     = "roles/run.invoker"
  member   = "allUsers"
}

# The application must use this gateway/proxy for peer calls; direct peer ingress is not exposed.
output "gateway_uri" {
  value       = try(google_cloud_run_v2_service.gateway[0].uri, null)
  description = "Platform gateway endpoint; peer traffic is routed through this proxy."
}