terraform {
  required_version = ">= 1.11.0, < 2.0.0"

  backend "pg" {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "ext_oci_relay"
  }

  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 8.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "5.10.1"
    }
  }
}

provider "vault" {}

ephemeral "vault_kv_secret_v2" "operator_api" {
  mount = "secret"
  name  = "oci/operator-api"
}

data "vault_generic_secret" "relay_config" {
  path = "secret/oci/relay/tofu-config"
}

locals {
  relay_config                       = data.vault_generic_secret.relay_config.data
  tenancy_ocid                       = nonsensitive(local.relay_config["tenancy_ocid"])
  region                             = nonsensitive(local.relay_config["region"])
  budget_alert_recipients            = local.relay_config["budget_alert_recipients"]
  monitoring_alert_email             = local.relay_config["budget_alert_recipients"]
  home_wireguard_public_key          = nonsensitive(local.relay_config["home_wireguard_public_key"])
  relay_image_ocid                   = nonsensitive(local.relay_config["relay_image_ocid"])
  publisher_api_public_key           = local.relay_config["publisher_api_public_key"]
  wan_controller_public_key          = local.relay_config["wan_controller_api_public_key"]
  publisher_email                    = local.relay_config["publisher_email"]
  smtp_deny_publisher_api_public_key = try(local.relay_config["smtp_deny_publisher_api_public_key"], "")
  smtp_deny_publisher_email          = try(local.relay_config["smtp_deny_publisher_email"], "")
  monitoring_alert_enabled           = nonsensitive(local.monitoring_alert_email) != ""
  publisher_enabled                  = nonsensitive(local.publisher_email) != ""
  smtp_deny_publisher_enabled        = var.mail_relay_enabled && nonsensitive(local.smtp_deny_publisher_email) != ""
  home_tunnel_address                = cidrhost(var.relay_tunnel_address, 2)
}

check "relay_vault_configuration" {
  assert {
    condition     = can(regex("^ocid1\\.tenancy\\.", local.tenancy_ocid))
    error_message = "The relay Vault configuration must contain an OCI tenancy OCID."
  }

  assert {
    condition     = can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.monitoring_alert_email))
    error_message = "The relay Vault alert recipient must be one email address."
  }

  assert {
    condition     = can(regex("^-----BEGIN PUBLIC KEY-----", local.publisher_api_public_key))
    error_message = "The relay Vault publisher public key must be PEM encoded."
  }

  assert {
    condition     = can(regex("^-----BEGIN PUBLIC KEY-----", local.wan_controller_public_key))
    error_message = "The relay Vault WAN controller public key must be PEM encoded."
  }

  assert {
    condition     = can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.publisher_email))
    error_message = "The relay Vault publisher email must be one email address."
  }

  assert {
    condition     = can(regex("^ocid1\\.image\\.", local.relay_image_ocid))
    error_message = "The relay Vault configuration must contain a custom relay image OCID."
  }
}

resource "terraform_data" "relay_configuration" {
  input = {
    imaps_health_check_enabled                   = var.imaps_health_check_enabled
    imaps_ingress_source_cidrs                   = var.imaps_ingress_source_cidrs
    mail_https_health_check_enabled              = var.mail_https_health_check_enabled
    mail_relay_enabled                           = var.mail_relay_enabled
    smtp_health_check_enabled                    = var.smtp_health_check_enabled
    smtp_ingress_source_cidrs                    = var.smtp_ingress_source_cidrs
    smtp_deny_maximum_addresses                  = var.smtp_deny_maximum_addresses
    smtp_deny_maximum_intervals                  = var.smtp_deny_maximum_intervals
    smtp_deny_maximum_lifetime_seconds           = var.smtp_deny_maximum_lifetime_seconds
    smtp_deny_maximum_observation_window_seconds = var.smtp_deny_maximum_observation_window_seconds
    smtp_deny_minimum_observations               = var.smtp_deny_minimum_observations
    smtp_evidence_snapshot_interval_seconds      = var.smtp_evidence_snapshot_interval_seconds
    relay_metrics_port                           = var.relay_metrics_port
    submissions_health_check_enabled             = var.submissions_health_check_enabled
    submissions_ingress_source_cidrs             = var.submissions_ingress_source_cidrs
    web_allow_maximum_addresses                  = var.web_allow_maximum_addresses
    web_allow_minimum_addresses                  = var.web_allow_minimum_addresses
    web_allow_minimum_intervals                  = var.web_allow_minimum_intervals
  }

  lifecycle {
    precondition {
      condition = var.mail_relay_enabled || alltrue([
        for source_cidrs in values(local.mail_ingress_source_cidrs_by_port) : length(source_cidrs) == 0
      ])
      error_message = "Mail ingress sources cannot be admitted while relay guest mail forwarding is disabled."
    }

    precondition {
      condition = var.mail_relay_enabled || !anytrue(concat(
        values(local.mail_health_checks_by_port),
        [var.mail_https_health_check_enabled]
      ))
      error_message = "Mail health checks cannot be enabled while relay guest mail forwarding is disabled."
    }

    precondition {
      condition     = !var.mail_relay_enabled || can(regex("^-----BEGIN PUBLIC KEY-----", local.smtp_deny_publisher_api_public_key))
      error_message = "The relay Vault SMTP deny publisher public key must be PEM encoded when mail relay is enabled."
    }

    precondition {
      condition     = !var.mail_relay_enabled || can(regex("^[^@[:space:]]+@[^@[:space:]]+$", local.smtp_deny_publisher_email))
      error_message = "The relay Vault SMTP deny publisher email must be one email address when mail relay is enabled."
    }
  }
}

provider "oci" {
  auth         = "APIKey"
  tenancy_ocid = ephemeral.vault_kv_secret_v2.operator_api.data["tenancy_ocid"]
  user_ocid    = ephemeral.vault_kv_secret_v2.operator_api.data["user_ocid"]
  fingerprint  = ephemeral.vault_kv_secret_v2.operator_api.data["fingerprint"]
  private_key  = ephemeral.vault_kv_secret_v2.operator_api.data["private_key"]
  region       = ephemeral.vault_kv_secret_v2.operator_api.data["region"]
}