data "http" "repo_gpg_key" {
  url = "${var.repo_url}/repository.key"
}

locals {
  supply_pki = var.ca_cert_file != ""

  cloud_init_vars = {
    hostname            = var.name
    fqdn                = var.local_fqdn
    repo_url            = var.repo_url
    repo_gpg_key        = data.http.repo_gpg_key.response_body
    ubuntu_codename     = var.ubuntu_codename
    platform            = "gcp"
    mode                = "auto"
    external_interface  = ""
    internal_interface  = ""
    local_id_mode       = var.local_id_mode
    local_cidrs         = var.local_cidrs
    int_addr            = ""
    int_gateway_ip      = ""
    remote_addrs        = var.remote_addrs
    remote_id           = var.remote_id
    remote_cidrs        = var.remote_cidrs
    psk_b64             = base64encode(var.psk)
    p2s_enabled         = var.p2s_enabled
    p2s_address_pool    = var.p2s_address_pool
    p2s_ca_name         = "VPN Router CA"
    wg_enabled          = var.wireguard_enabled
    wg_address          = var.wireguard_address
    wg_listen_port      = var.wireguard_listen_port
  }

  cloud_init_rendered = local.supply_pki ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
    label       = split(".", var.local_fqdn)[0]
    ca_cert     = file(var.ca_cert_file)
    server_cert = file(var.server_cert_file)
    server_key  = file(var.server_key_file)
  })) : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
}

resource "google_compute_address" "ext" {
  name   = "${var.name}-ext"
  region = var.region
}

resource "google_compute_instance" "router" {
  name         = var.name
  machine_type = var.machine_type
  zone         = var.zone
  tags         = ["${var.name}-router"]

  can_ip_forward = true

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
    }
  }

  network_interface {
    network    = google_compute_network.ext.id
    subnetwork = google_compute_subnetwork.ext.id

    access_config {
      nat_ip = google_compute_address.ext.address
    }
  }

  network_interface {
    network    = google_compute_network.internal.id
    subnetwork = google_compute_subnetwork.int.id
  }

  metadata = {
    ssh-keys  = "${var.admin_username}:${var.admin_ssh_public_key}"
    user-data = local.cloud_init_rendered
  }
}