# Keycloak cluster of the S2I2S OpenStack project.
#
# Two VMs in hard anti affinity ('anti-affinity' server group policy: the
# scheduler fails instead of putting them on the same hypervisor), 30 GB of root
# disk, m1.medium (RAM 4 - VCPUs 2), no data volume.
#
# Each instance has two interfaces:
#   - the main private network (10.10.0.163, 10.10.0.164), where the L7 HAPROXY
#     load balancers and Prometheus reach it;
#   - the dedicated network of the database, the only way to PostgreSQL. The
#     address comes from the allocation pool of that subnet.
#
# Apply order: main_net_dns_router -> project-setup -> postgresql -> this one.

data "terraform_remote_state" "privnet_dns_router" {
  backend = "local"
  config = {
    path = "../main_net_dns_router/terraform.tfstate"
  }
}

data "terraform_remote_state" "project_setup" {
  backend = "local"
  config = {
    path = "../project-setup/terraform.tfstate"
  }
}

# Dedicated network and client security group of the database
data "terraform_remote_state" "postgresql" {
  backend = "local"
  config = {
    path = "../postgresql/terraform.tfstate"
  }
}

module "labs_common_variables" {
  source = "../../modules/labs_common_variables"
}

module "project_variables" {
  source = "../variables"
}

module "ssh_settings" {
  source = "../../modules/ssh-key-ref"
}

locals {
  # From the network/DNS state
  dns_zone                = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone
  dns_zone_id             = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone_id
  main_private_network_id = data.terraform_remote_state.privnet_dns_router.outputs.main_private_network_id
  main_private_subnet_id  = data.terraform_remote_state.privnet_dns_router.outputs.main_subnet_network_id

  # From the project setup state
  default_security_group_id = data.terraform_remote_state.project_setup.outputs.default_security_group_id
  basic_services_ip         = data.terraform_remote_state.project_setup.outputs.basic_services_ip
  main_haproxy_l7_ip        = data.terraform_remote_state.project_setup.outputs.main_haproxy_l7_ip
  main_loadbalancer_name    = data.terraform_remote_state.project_setup.outputs.main_loadbalancer_hostname

  # From the postgresql state
  postgresql_network_id               = data.terraform_remote_state.postgresql.outputs.postgresql_network_id
  postgresql_subnet_id                = data.terraform_remote_state.postgresql.outputs.postgresql_subnet_id
  postgresql_client_security_group_id = data.terraform_remote_state.postgresql.outputs.postgresql_client_access_security_group_id

  # From the common and project variables
  availability_zone    = module.labs_common_variables.availability_zones_names.availability_zone_no_gpu
  ubuntu_2404          = module.labs_common_variables.ubuntu_2404
  ubuntu2404_data_file = module.labs_common_variables.ubuntu2404_data_file
  keycloak_ip          = module.project_variables.keycloak_ip
}

module "keycloak" {
  source = "../../modules/keycloak"

  # Address plan of the project. The sizing comes from the module defaults
  keycloak_ip = local.keycloak_ip

  main_private_network_id   = local.main_private_network_id
  main_private_subnet_id    = local.main_private_subnet_id
  default_security_group_id = local.default_security_group_id
  haproxy_l7_ip             = local.main_haproxy_l7_ip
  prometheus_cidr           = local.basic_services_ip.prometheus_cidr

  postgresql_network_id               = local.postgresql_network_id
  postgresql_subnet_id                = local.postgresql_subnet_id
  postgresql_client_security_group_id = local.postgresql_client_security_group_id

  availability_zone = local.availability_zone
  image = {
    uuid           = local.ubuntu_2404.uuid
    user_data_file = local.ubuntu2404_data_file
  }
  ssh_key_name = module.ssh_settings.ssh_key_name

  # The service is published by the main load balancer, so the public name is a
  # CNAME to it
  dns_zone_id           = local.dns_zone_id
  keycloak_cname_target = local.main_loadbalancer_name
  keycloak_recordsets = {
    accounts = {
      name        = "accounts.${local.dns_zone.name}"
      description = "Keycloak of the S2I2S project, published by the main load balancer"
    }
  }
}