# Bare VM on the workload subnet, for manually verifying that its traffic to
# remote_cidrs flows through the router. Off by default so a plain apply
# stays to just the router.

resource "azurerm_network_interface" "workload" {
  count               = var.deploy_workload_vm ? 1 : 0
  name                = "${var.name}-workload-nic"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location

  ip_configuration {
    name                          = "workload"
    subnet_id                     = azurerm_subnet.workload.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "workload" {
  count                            = var.deploy_workload_vm ? 1 : 0
  name                             = "${var.name}-workload"
  resource_group_name              = azurerm_resource_group.this.name
  location                         = azurerm_resource_group.this.location
  size                             = var.vm_size
  admin_username                   = var.admin_username
  disable_password_authentication  = true
  network_interface_ids            = [azurerm_network_interface.workload[0].id]

  admin_ssh_key {
    username   = var.admin_username
    public_key = var.admin_ssh_public_key
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "StandardSSD_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "ubuntu-24_04-lts"
    sku       = "server"
    version   = "latest"
  }
}