resource "oci_identity_compartment" "ingress" {
  provider       = oci.home
  compartment_id = local.tenancy
  name           = "short"
  description    = "Tier S ingress through NLB and Site-to-Site VPN"
  enable_delete  = true
}
resource "oci_core_vcn" "ingress" {
  compartment_id = oci_identity_compartment.ingress.id
  cidr_blocks    = [var.vcn_cidr]
  display_name   = "short"
  # OCI DNS labels cannot change without replacing the network.
  dns_label      = "latency"
}
resource "oci_core_internet_gateway" "ingress" {
  compartment_id = oci_identity_compartment.ingress.id
  vcn_id         = oci_core_vcn.ingress.id
  display_name   = "short"
  enabled        = true
}
resource "oci_core_drg" "ingress" {
  compartment_id = oci_identity_compartment.ingress.id
  display_name   = "short"
}
resource "oci_core_drg_attachment" "ingress" {
  drg_id = oci_core_drg.ingress.id
  network_details {
    id   = oci_core_vcn.ingress.id
    type = "VCN"
  }
  display_name = "short"
}
resource "oci_core_route_table" "ingress" {
  compartment_id = oci_identity_compartment.ingress.id
  vcn_id         = oci_core_vcn.ingress.id
  route_rules {
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_internet_gateway.ingress.id
  }
  route_rules {
    destination       = "${var.tunnel_address}/32"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_drg.ingress.id
  }
}
resource "oci_core_security_list" "empty" {
  compartment_id = oci_identity_compartment.ingress.id
  vcn_id         = oci_core_vcn.ingress.id
  display_name   = "short-empty"
}
resource "oci_core_subnet" "ingress" {
  compartment_id    = oci_identity_compartment.ingress.id
  vcn_id            = oci_core_vcn.ingress.id
  cidr_block        = var.subnet_cidr
  display_name      = "short"
  dns_label         = "ingress"
  route_table_id    = oci_core_route_table.ingress.id
  security_list_ids = [oci_core_security_list.empty.id]
}
resource "oci_core_network_security_group" "ingress" {
  compartment_id = oci_identity_compartment.ingress.id
  vcn_id         = oci_core_vcn.ingress.id
  display_name   = "short"
}
resource "oci_core_network_security_group_security_rule" "web" {
  for_each                  = toset(["80", "443"])
  network_security_group_id = oci_core_network_security_group.ingress.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = "0.0.0.0/0"
  source_type               = "CIDR_BLOCK"
  tcp_options {
    destination_port_range {
      min = tonumber(each.value)
      max = tonumber(each.value)
    }
  }
}
resource "oci_core_network_security_group_security_rule" "backend" {
  for_each                  = toset(["80", "443"])
  network_security_group_id = oci_core_network_security_group.ingress.id
  direction                 = "EGRESS"
  protocol                  = "6"
  destination               = "${var.tunnel_address}/32"
  destination_type          = "CIDR_BLOCK"
  tcp_options {
    destination_port_range {
      min = tonumber(each.value)
      max = tonumber(each.value)
    }
  }
}