resource "random_string" "rds_password" {
  length = 16
  special = true
  override_special = "!#+"
}

resource "aws_secretsmanager_secret" "auth_service_mysql_pass" {
  name = "mysql_pass_permission_server"
  description = "The password of the MYSQL RDS instance that stores permissions."
}

resource "aws_secretsmanager_secret_version" "auth_service_mysql_pass" {
  secret_id = aws_secretsmanager_secret.auth_service_mysql_pass.id
  secret_string = random_string.rds_password.result
  version_stages = [var.subdomain_map[local.env_account]]
}

resource "aws_db_parameter_group" "auth_service_db" {
  name   = "authority-service-db"
  family = "mysql8.0"

  parameter {
    name  = "character_set_client"
    value = "utf8mb4"
  }

  parameter {
    name  = "character_set_server"
    value = "utf8mb4"
  }

  parameter {
    name         = "skip_name_resolve"
    value        = "1"
    apply_method = "pending-reboot"
  }
}

data "aws_db_instance" "master" {
  provider = aws.us-east-1
  db_instance_identifier = local.rds_instance_name
}

module rds_mysql_permission {

  source = "git::ssh://git@bitbucket.org/netfoundry/nf-mop-tf.git//modules/aws/rds"

  rds_instance_name     = local.rds_instance_name
  rds_allocated_storage = local.rds_disk_size
  rds_engine_type       = "mysql"
  rds_engine_version    = data.aws_db_instance.master.engine_version
  rds_instance_class    = local.rds_instance_class
  skip_final_snapshot   = true
  database_name         = "permissions"
  database_user         = "permission"
  database_password     = random_string.rds_password.result
  db_parameter_group    = aws_db_parameter_group.auth_service_db.id
  rds_security_group_id = data.terraform_remote_state.mop_core.outputs.sg_mysql_id

  subnet_az1 = data.terraform_remote_state.mop_core.outputs.vpc_subnet_private_ids[0]
  subnet_az2 = data.terraform_remote_state.mop_core.outputs.vpc_subnet_private_ids[1]
  subnet_az3 = data.terraform_remote_state.mop_core.outputs.vpc_subnet_private_ids[2]
  replicate_source_db = local.replicate_source_db
}