locals {
  health_check_vantage_points  = ["aws-tyo", "azr-sin", "goo-cbf"]
  relay_alarm_pending_duration = "PT3M"
}

resource "oci_health_checks_ping_monitor" "relay_http" {
  compartment_id      = local.compartment_id
  display_name        = "oci-l4-relay-http"
  interval_in_seconds = 60
  is_enabled          = true
  port                = 80
  protocol            = "TCP"
  targets             = [oci_core_public_ip.relay.ip_address]
  timeout_in_seconds  = 10
  vantage_point_names = local.health_check_vantage_points
  freeform_tags       = var.freeform_tags
}

resource "oci_health_checks_http_monitor" "relay_https" {
  compartment_id      = local.compartment_id
  display_name        = "oci-l4-relay-https"
  headers             = { Host = "auth.quorate.dev" }
  interval_in_seconds = 60
  is_enabled          = true
  method              = "GET"
  path                = "/.well-known/openid-configuration"
  port                = 443
  protocol            = "HTTPS"
  targets             = [oci_core_public_ip.relay.ip_address]
  timeout_in_seconds  = 10
  vantage_point_names = local.health_check_vantage_points
  freeform_tags       = var.freeform_tags
}

resource "oci_health_checks_http_monitor" "relay_mail_https" {
  count = var.mail_https_health_check_enabled ? 1 : 0

  compartment_id      = local.compartment_id
  display_name        = "oci-l4-relay-mail-https"
  headers             = { Host = "mail.quorate.dev" }
  interval_in_seconds = 60
  is_enabled          = true
  method              = "GET"
  path                = "/healthz/live"
  port                = 443
  protocol            = "HTTPS"
  targets             = [oci_core_public_ip.relay.ip_address]
  timeout_in_seconds  = 10
  vantage_point_names = local.health_check_vantage_points
  freeform_tags       = var.freeform_tags
}

resource "oci_health_checks_ping_monitor" "relay_mail" {
  for_each = toset([
    for port, enabled in local.mail_health_checks_by_port : port if enabled
  ])

  compartment_id      = local.compartment_id
  display_name        = "oci-l4-relay-mail-${each.value}"
  interval_in_seconds = 60
  is_enabled          = true
  port                = tonumber(each.value)
  protocol            = "TCP"
  targets             = [oci_core_public_ip.relay.ip_address]
  timeout_in_seconds  = 10
  vantage_point_names = local.health_check_vantage_points
  freeform_tags       = var.freeform_tags
}

resource "oci_ons_notification_topic" "relay" {
  compartment_id = local.compartment_id
  name           = "oci-l4-relay-alerts"
  description    = "Relay availability and health alerts"
  freeform_tags  = var.freeform_tags
}

resource "oci_ons_subscription" "relay_email" {
  count = local.monitoring_alert_enabled ? 1 : 0

  compartment_id = local.compartment_id
  endpoint       = local.monitoring_alert_email
  protocol       = "EMAIL"
  topic_id       = oci_ons_notification_topic.relay.id
  freeform_tags  = var.freeform_tags
}

resource "oci_monitoring_alarm" "relay_reachability" {
  body                         = "At least two external vantage points cannot reach relay HTTP."
  compartment_id               = local.compartment_id
  destinations                 = [oci_ons_notification_topic.relay.id]
  display_name                 = "oci-l4-relay-reachability"
  is_enabled                   = true
  message_format               = "ONS_OPTIMIZED"
  metric_compartment_id        = local.compartment_id
  namespace                    = "oci_healthchecks"
  pending_duration             = local.relay_alarm_pending_duration
  query                        = "PING.isHealthy[1m]{resourceId = \"${oci_health_checks_ping_monitor.relay_http.id}\"}.grouping().mean() < 0.5"
  repeat_notification_duration = "PT2H"
  resolution                   = "1m"
  severity                     = "CRITICAL"
  freeform_tags                = var.freeform_tags
}

resource "oci_monitoring_alarm" "relay_https" {
  body                         = "At least two external vantage points report unhealthy relay HTTPS while relay HTTP remains reachable."
  compartment_id               = local.compartment_id
  destinations                 = [oci_ons_notification_topic.relay.id]
  display_name                 = "oci-l4-relay-https"
  is_enabled                   = true
  message_format               = "ONS_OPTIMIZED"
  metric_compartment_id        = local.compartment_id
  namespace                    = "oci_healthchecks"
  pending_duration             = local.relay_alarm_pending_duration
  query                        = "HTTP.isHealthy[1m]{resourceId = \"${oci_health_checks_http_monitor.relay_https.id}\"}.grouping().mean() < 0.5 && PING.isHealthy[1m]{resourceId = \"${oci_health_checks_ping_monitor.relay_http.id}\"}.grouping().mean() >= 0.5"
  repeat_notification_duration = "PT2H"
  resolution                   = "1m"
  severity                     = "CRITICAL"
  freeform_tags                = var.freeform_tags
}

resource "oci_monitoring_alarm" "relay_mail_https" {
  count = var.mail_https_health_check_enabled ? 1 : 0

  body                         = "At least two external vantage points report unhealthy Stalwart user HTTPS while relay HTTP remains reachable."
  compartment_id               = local.compartment_id
  destinations                 = [oci_ons_notification_topic.relay.id]
  display_name                 = "oci-l4-relay-mail-https"
  is_enabled                   = true
  message_format               = "ONS_OPTIMIZED"
  metric_compartment_id        = local.compartment_id
  namespace                    = "oci_healthchecks"
  pending_duration             = local.relay_alarm_pending_duration
  query                        = "HTTP.isHealthy[1m]{resourceId = \"${oci_health_checks_http_monitor.relay_mail_https[0].id}\"}.grouping().mean() < 0.5 && PING.isHealthy[1m]{resourceId = \"${oci_health_checks_ping_monitor.relay_http.id}\"}.grouping().mean() >= 0.5"
  repeat_notification_duration = "PT2H"
  resolution                   = "1m"
  severity                     = "CRITICAL"
  freeform_tags                = var.freeform_tags
}

resource "oci_monitoring_alarm" "relay_mail" {
  for_each = oci_health_checks_ping_monitor.relay_mail

  body                         = "At least two external vantage points cannot reach relay mail TCP/${each.key} while relay HTTP remains reachable."
  compartment_id               = local.compartment_id
  destinations                 = [oci_ons_notification_topic.relay.id]
  display_name                 = "oci-l4-relay-mail-${each.key}"
  is_enabled                   = true
  message_format               = "ONS_OPTIMIZED"
  metric_compartment_id        = local.compartment_id
  namespace                    = "oci_healthchecks"
  pending_duration             = local.relay_alarm_pending_duration
  query                        = "PING.isHealthy[1m]{resourceId = \"${each.value.id}\"}.grouping().mean() < 0.5 && PING.isHealthy[1m]{resourceId = \"${oci_health_checks_ping_monitor.relay_http.id}\"}.grouping().mean() >= 0.5"
  repeat_notification_duration = "PT2H"
  resolution                   = "1m"
  severity                     = "CRITICAL"
  freeform_tags                = var.freeform_tags
}