# Root module: wires together the shared network and the three host modules
# (one per server in docs/architecture.md). Each host module owns its own
# firewall (and volume, where applicable) - see modules/<host>/main.tf.

locals {
  # SSH to dev/prod is only permitted from the vpn server's public IP: admins must
  # tunnel through the VPN first, whose egress traffic is then sourced from this IP.
  # vpn itself can't require tunneling through itself, so it keeps
  # var.allowed_ssh_source_ips for direct SSH access.
  vpn_ssh_source_ips = ["${module.vpn.ipv4}/32"]

  # Rendered once and uploaded+run by every host module immediately after its
  # server is created - see scripts/bootstrap.sh.tftpl.
  bootstrap_script = templatefile("${path.module}/scripts/bootstrap.sh.tftpl", {
    deploy_user = var.deploy_user
  })
}

module "network" {
  source = "./modules/network"

  ip_range        = var.network_ip_range
  network_zone    = var.network_zone
  subnet_ip_range = var.subnet_ip_range
}

module "dev" {
  source = "./modules/dev"

  server_type            = var.dev_server_type
  image                  = var.server_image
  location               = var.location
  ssh_key_id             = data.hcloud_ssh_key.main.id
  network_id             = module.network.id
  private_ip             = var.dev_private_ip
  volume_size            = var.dev_volume_size
  allowed_ssh_source_ips = local.vpn_ssh_source_ips
  network_ip_range       = var.network_ip_range
  bootstrap_script       = local.bootstrap_script
  ssh_private_key_path   = var.ssh_private_key_path
  runner_count           = var.dev_runner_count

  # module.network.id alone doesn't guarantee the subnet exists yet, and a server
  # can't join a network before it has a subnet.
  depends_on = [module.network]
}

module "prod" {
  source = "./modules/prod"

  server_type            = var.prod_server_type
  image                  = var.server_image
  location               = var.location
  ssh_key_id             = data.hcloud_ssh_key.main.id
  network_id             = module.network.id
  private_ip             = var.prod_private_ip
  volume_size            = var.prod_volume_size
  allowed_ssh_source_ips = local.vpn_ssh_source_ips
  network_ip_range       = var.network_ip_range
  bootstrap_script       = local.bootstrap_script
  ssh_private_key_path   = var.ssh_private_key_path

  depends_on = [module.network]
}

module "vpn" {
  source = "./modules/vpn"

  server_type            = var.vpn_server_type
  image                  = var.server_image
  location               = var.location
  ssh_key_id             = data.hcloud_ssh_key.main.id
  allowed_ssh_source_ips = var.allowed_ssh_source_ips
  bootstrap_script       = local.bootstrap_script
  ssh_private_key_path   = var.ssh_private_key_path
}