# No se usa data "aws_ami" con most_recent: en la lista de AMIs de Palo Alto
# la 11.1.15 es una release MAS nueva que la 11.1.6-h35, pero su AMI tiene
# fecha ANTERIOR. Ordenar por CreationDate elige la version equivocada.
data "aws_ssm_parameter" "panos" {
  count = var.panos_ami_id == "" ? 1 : 0
  name  = var.panos_ssm_parameter
}

locals {
  panos_ami = var.panos_ami_id != "" ? var.panos_ami_id : data.aws_ssm_parameter.panos[0].value
}

# Dos NICs: gestion y datos. Sin overlay routing, sin NAT, sin interfaz
# untrust. Todo el trafico entra y sale encapsulado en GENEVE por eth1.

resource "aws_network_interface" "fw_mgmt" {
  for_each        = local.subnets
  subnet_id       = aws_subnet.mgmt[each.key].id
  security_groups = [aws_security_group.mgmt.id]
  tags            = { Name = "kf-fw-${each.key}-mgmt" }
}

resource "aws_network_interface" "fw_data" {
  for_each          = local.subnets
  subnet_id         = aws_subnet.fwdata[each.key].id
  security_groups   = [aws_security_group.fwdata.id]
  source_dest_check = false
  tags              = { Name = "kf-fw-${each.key}-data" }
}

resource "aws_eip" "fw_mgmt" {
  for_each          = local.subnets
  domain            = "vpc"
  network_interface = aws_network_interface.fw_mgmt[each.key].id
  tags              = { Name = "kf-eip-fw-${each.key}-mgmt" }
  depends_on        = [aws_internet_gateway.igw]
}

resource "aws_instance" "fw" {
  for_each      = local.subnets
  ami           = local.panos_ami
  instance_type = var.panos_instance_type
  key_name      = var.key_pair_name

  network_interface {
    network_interface_id = aws_network_interface.fw_mgmt[each.key].id
    device_index         = 0
  }
  network_interface {
    network_interface_id = aws_network_interface.fw_data[each.key].id
    device_index         = 1
  }

  user_data = <<-EOT
    type=dhcp-client
    hostname=kf-fw-gwlb-${each.key}
    dns-primary=169.254.169.253
    dns-secondary=8.8.8.8
    dhcp-accept-server-hostname=no
    dhcp-accept-server-domain=no
  EOT

  root_block_device {
    volume_size = 60
    volume_type = "gp3"
  }

  tags = { Name = "kf-fw-gwlb-${each.key}" }
}

# --- Workloads ---------------------------------------------------------------

data "aws_ami" "al2023" {
  most_recent = true
  owners      = ["amazon"]
  filter {
    name   = "name"
    values = ["al2023-ami-2023.*-x86_64"]
  }
}

# Sin IP publica. Se prueban desde el home lab por el tunel, que es
# justamente el escenario que se quiere demostrar.
resource "aws_instance" "app" {
  for_each = local.subnets

  ami                    = data.aws_ami.al2023.id
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.app[each.key].id
  private_ip             = cidrhost(local.subnets[each.key].app, 10)
  vpc_security_group_ids = [aws_security_group.app.id]
  key_name               = var.key_pair_name

  user_data = <<-EOT
    #!/bin/bash
    dnf install -y nginx
    echo "kf-gwlb-lab · stack ${each.key} · $(hostname)" > /usr/share/nginx/html/index.html
    systemctl enable --now nginx
  EOT

  tags = { Name = "kf-app-${each.key}" }
}