output "sbn_dmz_a_id" {
  value = aws_subnet.sbn-dmz-a.id
}

output "sbn_dmz_b_id" {
  value = aws_subnet.sbn-dmz-b.id
}

output "sbn_dmz_c_id" {
  value = aws_subnet.sbn-dmz-c.id
}



resource "aws_subnet" "sbn-dmz-a" {
  availability_zone                           = "ap-northeast-2a"
  cidr_block                                  = "172.21.0.0/28"
  enable_resource_name_dns_a_record_on_launch = true
  private_dns_hostname_type_on_launch         = "resource-name"
  tags = {
    "Name"                                                  = "sbn-dmz-a.datasaker"
    "SubnetType"                                            = "Public"
    "kubernetes.io/cluster/datasaker" = "owned"
    "kubernetes.io/role/elb"                                = "1"
    "kubernetes.io/role/internal-elb"                       = "1"
  }
  vpc_id = aws_vpc.vpc-datasaker.id
}

resource "aws_subnet" "sbn-dmz-b" {
  availability_zone                           = "ap-northeast-2b"
  cidr_block                                  = "172.21.0.16/28"
  enable_resource_name_dns_a_record_on_launch = true
  private_dns_hostname_type_on_launch         = "resource-name"
  tags = {
    "Name"                                                  = "sbn-dmz-b.datasaker"
    "SubnetType"                                            = "Public"
    "kubernetes.io/cluster/datasaker" = "owned"
    "kubernetes.io/role/elb"                                = "1"
    "kubernetes.io/role/internal-elb"                       = "1"
  }
  vpc_id = aws_vpc.vpc-datasaker.id
}

resource "aws_subnet" "sbn-dmz-c" {
  availability_zone                           = "ap-northeast-2c"
  cidr_block                                  = "172.21.0.32/28"
  enable_resource_name_dns_a_record_on_launch = true
  private_dns_hostname_type_on_launch         = "resource-name"
  tags = {
    "Name"                                                  = "sbn-dmz-c.datasaker"
    "SubnetType"                                            = "Public"
    "kubernetes.io/cluster/datasaker" = "owned"
    "kubernetes.io/role/elb"                                = "1"
    "kubernetes.io/role/internal-elb"                       = "1"
  }
  vpc_id = aws_vpc.vpc-datasaker.id
}



resource "aws_route_table_association" "rta-dmz-a" {
  route_table_id = aws_route_table.rt-datasaker-pub.id
  subnet_id      = aws_subnet.sbn-dmz-a.id
}

resource "aws_route_table_association" "rta-dmz-b" {
  route_table_id = aws_route_table.rt-datasaker-pub.id
  subnet_id      = aws_subnet.sbn-dmz-b.id
}

resource "aws_route_table_association" "rta-dmz-c" {
  route_table_id = aws_route_table.rt-datasaker-pub.id
  subnet_id      = aws_subnet.sbn-dmz-c.id
}



resource "aws_security_group" "sg-dmz-datasaker" {
  description = "Security group dmz-datasaker"
  name        = "secg-dmz-datasaker"
  tags = {
    "Name" = "sg-dmz-datasaker"
  }
  vpc_id = aws_vpc.vpc-datasaker.id
}

# resource "aws_security_group_rule" "sgr-from-0-0-0-0--0-ingress-tcp-22to22-dmz-datasaker-io" {
#   cidr_blocks       = ["0.0.0.0/0"]
#   from_port         = 22
#   protocol          = "tcp"
#   security_group_id = aws_security_group.sg-dmz-datasaker.id
#   to_port           = 22
#   type              = "ingress"
# }

resource "aws_security_group_rule" "sgr-from-115-178-73-2--32-ingress-tcp-22to22-dmz-datasaker-io" {
  cidr_blocks       = ["115.178.73.2/32"]
  from_port         = 22
  protocol          = "tcp"
  security_group_id = aws_security_group.sg-dmz-datasaker.id
  to_port           = 22
  type              = "ingress"
}

resource "aws_security_group_rule" "sgr-from-115-178-73-91--32-ingress-tcp-22to22-dmz-datasaker-io" {
  cidr_blocks       = ["115.178.73.91/32"]
  from_port         = 22
  protocol          = "tcp"
  security_group_id = aws_security_group.sg-dmz-datasaker.id
  to_port           = 22
  type              = "ingress"
}




# resource "aws_security_group_rule" "sgr-from-0-0-0-0--0-ingress-icmp-dmz-datasaker-io" {
#   cidr_blocks       = ["0.0.0.0/0"]
#   from_port         = 8
#   protocol          = "icmp"
#   security_group_id = aws_security_group.sg-dmz-datasaker.id
#   to_port           = 8
#   type              = "ingress"
# }

# resource "aws_security_group_rule" "sgr-to-0-0-0-0--0-egress-icmp-dmz-datasaker-io" {
#   cidr_blocks       = ["0.0.0.0/0"]
#   from_port         = 8
#   protocol          = "icmp"
#   security_group_id = aws_security_group.sg-dmz-datasaker.id
#   to_port           = 8
#   type              = "egress"
# }

resource "aws_security_group_rule" "sgr-from-0-0-0-0--0-engress-tcp-all-dmz-datasaker-io" {
  cidr_blocks       = ["0.0.0.0/0"]
  from_port         = 0
  protocol          = "tcp"
  security_group_id = aws_security_group.sg-dmz-datasaker.id
  to_port           = 65535
  type              = "egress"
}




resource "aws_launch_template" "lt-dmz-bastion-datasaker" {
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      delete_on_termination = true
      encrypted             = true
      iops                  = 3000
      throughput            = 125
      volume_size           = 20
      volume_type           = "gp3"
    }
  }


  image_id      = "ami-0ea5eb4b05645aa8a"
  instance_type = "t3.small"
  key_name      = aws_key_pair.kp-bastion-datasaker.id
  lifecycle {
    create_before_destroy = true
  }
  metadata_options {
    http_endpoint               = "enabled"
    http_protocol_ipv6          = "disabled"
    http_put_response_hop_limit = 3
    http_tokens                 = "required"
  }
  monitoring {
    enabled = false
  }
  name = "lt-dmz-bastion-datasaker"
  network_interfaces {
    associate_public_ip_address = true
    delete_on_termination = true
    ipv6_address_count = 0
    security_groups = [aws_security_group.sg-dmz-datasaker.id]
  }
  # tag_specifications {
  #   resource_type = "instance"
  #   tags = {
  #     "Name" = "lt-dmz-bastion-datasaker"
  #   }
  # }
  # tag_specifications {
  #   resource_type = "volume"
  #   tags = {
  #     "Name" = "master-ap-northeast-2b.masters.ap-northeast-2.dev.datasaker.io"
  #   }
  # }
  tags = {
    "Name" = "lt-dmz-bastion-datasaker"
  }
  # user_data = filebase64("${path.module}/data/aws_launch_template_master-ap-northeast-2b.masters.ap-northeast-2.dev.datasaker.io_user_data")
}

resource "aws_autoscaling_group" "ag-dmz-bastion-datasaker" {
  enabled_metrics = ["GroupDesiredCapacity", "GroupInServiceInstances", "GroupMaxSize", "GroupMinSize", "GroupPendingInstances", "GroupStandbyInstances", "GroupTerminatingInstances", "GroupTotalInstances"]
  launch_template {
    id      = aws_launch_template.lt-dmz-bastion-datasaker.id
    version = aws_launch_template.lt-dmz-bastion-datasaker.latest_version
  }
  max_instance_lifetime = 0
  max_size              = 1
  metrics_granularity   = "1Minute"
  min_size              = 1
  name                  = "ag-dmz-bastion-datasaker"
  protect_from_scale_in = false

  tag {
    key                 = "Name"
    propagate_at_launch = true
    value               = "ag-dmz-bastion-datasaker"
  }
  vpc_zone_identifier = [aws_subnet.sbn-dmz-a.id,aws_subnet.sbn-dmz-b.id]
}



resource "aws_eip" "eip-natgw-datasaker" {
  # instance = aws_instance.web1-ec2.id
  vpc      = true

  tags = {
    Name    = "eip-natgw-datasaker"
  }
}

resource "aws_nat_gateway" "natgw-datasaker" {
  allocation_id = aws_eip.eip-natgw-datasaker.id
  subnet_id     = aws_subnet.sbn-dmz-a.id

  tags = {
    Name = "natgw-datasaker"
  }

  # To ensure proper ordering, it is recommended to add an explicit dependency
  # on the Internet Gateway for the VPC.
  depends_on = [aws_internet_gateway.igw-datasaker]
}