terraform {
  required_version = ">= 1.8"

  required_providers {
    varnish = {
      source  = "varnish/varnish"
      version = "~> 0.1.1"
    }
    scaleway = {
      source  = "scaleway/scaleway"
      version = "~> 2.87"
    }
  }
}

# Credentials come from the environment, see setenv.sh.example:
# VARNISH_ACCESS_TOKEN
# SCW_ACCESS_KEY / SCW_SECRET_KEY / SCW_DEFAULT_PROJECT_ID.
provider "varnish" {}

provider "scaleway" {
  region = "fr-par"
}

variable "dns_zone" {
  type        = string
  description = "Scaleway-managed DNS zone the site lives in."
  default     = "tf.codito.info"
}

variable "subdomain" {
  type        = string
  description = "Label inside dns_zone that the CDN serves."
  default     = "test"
}

locals {
  fqdn = "${var.subdomain}.${var.dns_zone}"
  # public_endpoint is a URL; the CDN origin wants a bare hostname.
  origin_host = trimsuffix(trimprefix(scaleway_container.site.public_endpoint, "https://"), "/")
}

# ---------------------------------------------------------------------------
# Origin: a Scaleway serverless container
# ---------------------------------------------------------------------------
resource "scaleway_container_namespace" "site" {
  name = "codito-site"
}

resource "scaleway_container" "site" {
  name                   = "codito-site"
  namespace_id           = scaleway_container_namespace.site.id
  image                  = "ghcr.io/ullgren/originserver:sha-ae529bc"
  port                   = 8080
  cpu_limit              = 140
  memory_limit_bytes     = 256 * 1024 * 1024
  min_scale              = 0
  max_scale              = 2
  privacy                = "public"
  https_connections_only = true
}

# ---------------------------------------------------------------------------
# CDN service in front of the container
# ---------------------------------------------------------------------------
resource "varnish_cdn_service" "site" {
  domain {
    fqdn = local.fqdn
    tls  = true
  }

  origin {
    name       = "default"
    host       = local.origin_host
    port       = 443
    enable_tls = true
    is_default = true
    # Scaleway routes on Host, so it must be the container's own domain.
    host_header = local.origin_host
  }

  settings = {
    general = {
      enable_cacheable_ttl_override = true
      cacheable_ttl_override        = "5m"
    }
  }
}

data "varnish_cdn_domain_dns" "site" {
  service_id = varnish_cdn_service.site.id
  fqdn       = local.fqdn
}

# ---------------------------------------------------------------------------
# DNS in Scaleway
# ---------------------------------------------------------------------------
resource "scaleway_domain_record" "cname" {
  dns_zone = var.dns_zone
  name     = var.subdomain
  type     = "CNAME"
  data     = "${data.varnish_cdn_domain_dns.site.expected_cname}."
  ttl      = 60
}

# Ownership TXT sits on the zone apex: a CNAME label cannot carry other
# records, and the CDN also accepts the token on any parent name.
resource "scaleway_domain_record" "verify" {
  dns_zone = var.dns_zone
  name     = ""
  type     = "TXT"
  data     = data.varnish_cdn_domain_dns.site.expected_txt
  ttl      = 60
}

resource "scaleway_domain_record" "acme" {
  dns_zone = var.dns_zone
  name     = "_acme-challenge.${var.subdomain}"
  type     = "CNAME"
  data     = "${data.varnish_cdn_domain_dns.site.expected_acme_cname}."
  ttl      = 60
}

output "url" {
  value = "https://${local.fqdn}/"
}

output "origin" {
  value = "https://${local.origin_host}/"
}

output "cdn_cname" {
  value = data.varnish_cdn_domain_dns.site.expected_cname
}