resource "azurerm_resource_group" "this" {
  name     = "rg-${var.name}"
  location = var.location
}

resource "azurerm_virtual_network" "this" {
  name                = "vnet-${var.name}"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  address_space       = [var.vnet_address_space]
}

resource "azurerm_subnet" "ext" {
  name                 = "ext"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = [var.ext_subnet_cidr]
}

resource "azurerm_subnet" "int" {
  name                 = "int"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = [var.int_subnet_cidr]
}

resource "azurerm_subnet" "workload" {
  name                 = "workload"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = [var.workload_subnet_cidr]
}

resource "azurerm_dns_a_record" "router_ext" {
  count = var.dns_zone_id != null ? 1 : 0

  name                = trimsuffix(var.local_fqdn, ".${split("/", var.dns_zone_id)[length(split("/", var.dns_zone_id)) - 1]}")
  zone_name           = split("/", var.dns_zone_id)[length(split("/", var.dns_zone_id)) - 1]
  resource_group_name = split("/", var.dns_zone_id)[4]
  ttl                 = 300
  records             = [azurerm_public_ip.ext.ip_address]
}

resource "azurerm_network_security_group" "router_ext" {
  name                = "nsg-${var.name}-ext"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location

  security_rule {
    name                       = "Allow-SSH-TCP-22"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-IKE-UDP-500"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Udp"
    source_port_range          = "*"
    destination_port_range     = "500"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "Allow-IPsec-NAT-T-UDP-4500"
    priority                   = 120
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Udp"
    source_port_range          = "*"
    destination_port_range     = "4500"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  dynamic "security_rule" {
    for_each = var.wireguard_enabled ? [1] : []
    content {
      name                       = "Allow-WireGuard-UDP"
      priority                   = 130
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Udp"
      source_port_range          = "*"
      destination_port_range     = tostring(var.wireguard_listen_port)
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    }
  }
}

resource "azurerm_network_interface_security_group_association" "router_ext" {
  network_interface_id     = azurerm_network_interface.ext.id
  network_security_group_id = azurerm_network_security_group.router_ext.id
}