data "http" "repo_gpg_key" {
  url = "${var.repo_url}/repository.key"
}

locals {
  supply_pki = var.ca_cert_file != ""

  cloud_init_vars = {
    hostname        = var.name
    fqdn            = var.local_fqdn
    repo_url        = var.repo_url
    repo_gpg_key    = data.http.repo_gpg_key.response_body
    ubuntu_codename = var.ubuntu_codename

    # Contents of /etc/vpn-router/vpn-router.json.
    config = {
      general = { platform = "gcp", mode = "auto" }
      wan     = { local_fqdn = var.local_fqdn }
      local   = { cidrs = local.local_cidr_list }
      site_to_site = {
        "remote-site" = {
          addrs         = [for a in split(",", var.remote_addrs) : trimspace(a) if trimspace(a) != ""]
          id            = var.remote_id
          cidrs         = local.remote_cidr_list
          local_cidrs   = local.local_cidr_list
          local_id_mode = var.local_id_mode
          psk           = var.psk
        }
      }
      p2s       = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool, ca_name = "VPN Router CA" }
      wireguard = { enabled = var.wireguard_enabled, address = var.wireguard_address, listen_port = var.wireguard_listen_port }
    }
  }

  cloud_init_rendered = local.supply_pki ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
    label       = split(".", var.local_fqdn)[0]
    ca_cert     = file(var.ca_cert_file)
    server_cert = file(var.server_cert_file)
    server_key  = file(var.server_key_file)
  })) : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
}

resource "google_compute_address" "ext" {
  name   = "${var.name}-ext"
  region = var.region
}

resource "google_compute_instance" "router" {
  name         = var.name
  machine_type = var.machine_type
  zone         = var.zone
  tags         = ["${var.name}-router"]

  can_ip_forward = true

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
    }
  }

  network_interface {
    network    = google_compute_network.ext.id
    subnetwork = google_compute_subnetwork.ext.id

    access_config {
      nat_ip = google_compute_address.ext.address
    }
  }

  network_interface {
    network    = google_compute_network.internal.id
    subnetwork = google_compute_subnetwork.int.id
  }

  metadata = {
    ssh-keys  = "${var.admin_username}:${var.admin_ssh_public_key}"
    user-data = local.cloud_init_rendered
  }
}