data "http" "repo_gpg_key" {
  url = "${var.repo_url}/repository.key"
}

locals {
  supply_pki = var.ca_cert_file != ""

  cloud_init_vars = {
    hostname            = var.name
    fqdn                = var.local_fqdn
    repo_url            = var.repo_url
    repo_gpg_key        = data.http.repo_gpg_key.response_body
    ubuntu_codename     = var.ubuntu_codename
    platform            = "azure"
    mode                = "auto"
    external_interface  = ""
    internal_interface  = ""
    local_id_mode       = var.local_id_mode
    local_cidrs         = var.local_cidrs
    int_addr            = ""
    int_gateway_ip      = ""
    remote_addrs        = var.remote_addrs
    remote_id           = var.remote_id
    remote_cidrs        = var.remote_cidrs
    psk_b64             = base64encode(var.psk)
    p2s_enabled         = var.p2s_enabled
    p2s_address_pool    = var.p2s_address_pool
    p2s_ca_name         = "VPN Router CA"
    wg_enabled          = var.wireguard_enabled
    wg_address          = var.wireguard_address
    wg_listen_port      = var.wireguard_listen_port
  }
}

resource "azurerm_public_ip" "ext" {
  name                = "pip-${var.name}-ext"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_network_interface" "ext" {
  name                  = "${var.name}-ext-nic"
  resource_group_name  = azurerm_resource_group.this.name
  location              = azurerm_resource_group.this.location
  ip_forwarding_enabled = true

  ip_configuration {
    name                          = "ext"
    subnet_id                     = azurerm_subnet.ext.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.ext.id
  }
}

resource "azurerm_network_interface" "int" {
  name                  = "${var.name}-int-nic"
  resource_group_name  = azurerm_resource_group.this.name
  location              = azurerm_resource_group.this.location
  ip_forwarding_enabled = true

  ip_configuration {
    name                          = "int"
    subnet_id                     = azurerm_subnet.int.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_linux_virtual_machine" "router" {
  name                            = var.name
  resource_group_name             = azurerm_resource_group.this.name
  location                        = azurerm_resource_group.this.location
  size                             = var.vm_size
  admin_username                   = var.admin_username
  admin_password                   = var.admin_password != "" ? var.admin_password : null
  disable_password_authentication  = var.admin_password == ""

  network_interface_ids = [
    azurerm_network_interface.ext.id,
    azurerm_network_interface.int.id,
  ]

  admin_ssh_key {
    username   = var.admin_username
    public_key = var.admin_ssh_public_key
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "StandardSSD_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "ubuntu-24_04-lts"
    sku       = "server"
    version   = "latest"
  }

  custom_data = base64encode(
    local.supply_pki
    ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
      label       = split(".", var.local_fqdn)[0]
      ca_cert     = file(var.ca_cert_file)
      server_cert = file(var.server_cert_file)
      server_key  = file(var.server_key_file)
    }))
    : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
  )
}