# vpn: OpenVPN + Traefik. Not attached to the private network (see docs/architecture.md).
resource "hcloud_firewall" "this" {
  name = "vpn-firewall"

  rule { # server ssh
    direction  = "in"
    protocol   = "tcp"
    port       = "22"
    source_ips = var.allowed_ssh_source_ips
  }

  rule { # Traefik http/https (traefik.vpn.luke-else.co.uk)
    direction  = "in"
    protocol   = "tcp"
    port       = "80"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "443"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule { # OpenVPN tunnel - always direct to this server's public IP, never via a load balancer
    direction  = "in"
    protocol   = "udp"
    port       = "1194"
    source_ips = ["0.0.0.0/0", "::/0"]
  }
}

resource "hcloud_server" "this" {
  name         = "vpn"
  server_type  = var.server_type
  image        = var.image
  location     = var.location
  ssh_keys     = var.ssh_key_ids
  firewall_ids = [hcloud_firewall.this.id]

  connection {
    type        = "ssh"
    host        = self.ipv4_address
    user        = "root"
    private_key = file(var.ssh_private_key_path)
  }

  provisioner "file" {
    content     = var.bootstrap_script
    destination = "/root/bootstrap.sh"
  }

  provisioner "remote-exec" {
    inline = [
      "chmod +x /root/bootstrap.sh",
      "/root/bootstrap.sh",
    ]
  }
}

locals {
  vpn_static_files = sort(fileset("${path.root}/../services/vpn", "**"))

  vpn_static_files_hash = sha1(join("", [
    for f in local.vpn_static_files : filesha1("${path.root}/../services/vpn/${f}")
  ]))
}

# Copies services/vpn to the server on every apply that changes it (a
# hand-edited compose file, ...) or recreates the server - not just once at
# first creation. Split from hcloud_server.this so it's triggered by content
# changes independently of the bootstrap provisioners above.
resource "null_resource" "deploy_services" {
  triggers = {
    server_id    = hcloud_server.this.id
    static_files = local.vpn_static_files_hash
  }

  connection {
    type        = "ssh"
    host        = hcloud_server.this.ipv4_address
    user        = "root"
    private_key = file(var.ssh_private_key_path)
  }

  provisioner "remote-exec" {
    inline = ["mkdir -p /home/${var.deploy_user}/services"]
  }

  provisioner "file" {
    source      = "${path.root}/../services/vpn"
    destination = "/home/${var.deploy_user}/services"
  }

  provisioner "remote-exec" {
    inline = [
      "chown -R ${var.deploy_user}:${var.deploy_user} /home/${var.deploy_user}/services",
      "chmod +x /home/${var.deploy_user}/services/vpn/*.sh",
    ]
  }

  depends_on = [hcloud_server.this]
}