# SeaweedFS HA on AWS: 3-master quorum + 3 volume servers (one per AZ) + 2
# filers (leveldb2-replicated HA) + 1 standalone S3 gateway.
#
#   tofu init && tofu validate
#   tofu apply   # requires AWS credentials, a VPC, subnets, and a weed AMI
#
# This is a scaffold: it provisions instances, protected EBS data disks, and the
# security group. Mounting the EBS disk at /data and secret-store cert delivery
# are documented follow-ups (see terraform/README.md).

terraform {
  required_version = ">= 1.3.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.40"
    }
  }
}

provider "aws" {
  region = var.region
}

variable "region" {
  type    = string
  default = "us-east-1"
}

variable "vpc_id" {
  type = string
}

variable "ami_id" {
  description = "AMI with the weed binary at /usr/bin/weed."
  type        = string
}

# subnet per AZ
variable "subnet_a" { type = string }
variable "subnet_b" { type = string }
variable "subnet_c" { type = string }

# AZ defaults assume region us-east-1. When you change `region`, override az_a/az_b/az_c
# (and the matching subnets) with AZs that belong to that region, or the volume/filer
# EBS volumes will fail to create in a mismatched AZ.
variable "az_a" {
  type    = string
  default = "us-east-1a"
}
variable "az_b" {
  type    = string
  default = "us-east-1b"
}
variable "az_c" {
  type    = string
  default = "us-east-1c"
}

variable "client_ingress_cidrs" {
  type    = list(string)
  default = ["10.0.0.0/8"]
}

variable "ssh_ingress_cidrs" {
  type    = list(string)
  default = []
}

module "seaweedfs" {
  source = "../../modules/aws"

  name   = "seaweedfs"
  vpc_id = var.vpc_id
  ami_id = var.ami_id

  # secure-by-default flagship: mTLS (certs + JWT generated by the security
  # submodule, delivered via SSM and fetched at boot) plus monitoring.
  enable_security    = true
  monitoring_enabled = true

  masters = {
    m0 = { subnet_id = var.subnet_a, private_ip = "10.0.1.10" }
    m1 = { subnet_id = var.subnet_b, private_ip = "10.0.2.10" }
    m2 = { subnet_id = var.subnet_c, private_ip = "10.0.3.10" }
  }

  volumes = {
    v0 = { subnet_id = var.subnet_a, availability_zone = var.az_a, private_ip = "10.0.1.20", rack = var.az_a, data_center = var.region, data_volume_size_gb = 500 }
    v1 = { subnet_id = var.subnet_b, availability_zone = var.az_b, private_ip = "10.0.2.20", rack = var.az_b, data_center = var.region, data_volume_size_gb = 500 }
    v2 = { subnet_id = var.subnet_c, availability_zone = var.az_c, private_ip = "10.0.3.20", rack = var.az_c, data_center = var.region, data_volume_size_gb = 500 }
  }

  filers = {
    f0 = { subnet_id = var.subnet_a, availability_zone = var.az_a, private_ip = "10.0.1.30" }
    f1 = { subnet_id = var.subnet_b, availability_zone = var.az_b, private_ip = "10.0.2.30" }
  }

  s3_nodes = {
    s0 = { subnet_id = var.subnet_a, private_ip = "10.0.1.40" }
  }

  client_ingress_cidrs = var.client_ingress_cidrs
  ssh_ingress_cidrs    = var.ssh_ingress_cidrs
}

output "master_peers" {
  value = module.seaweedfs.master_peers
}

output "instance_ids" {
  value = module.seaweedfs.instance_ids
}

output "security_group_id" {
  value = module.seaweedfs.security_group_id
}