#
# Keycloak cluster.
#
# Derived from the d4science 'keycloak' module, rewritten for this repository:
# the ports are separate resources, the security groups go on the ports, and
# nothing is read from another state inside the module. The addresses of the
# instances are known in advance (keycloak_ip), so the rules of the cluster
# security group do not depend on the instances being created first.
#

variable "keycloak_data" {
  description = "Instances of the keycloak cluster. m1.medium is RAM 4 - VCPUs 2"
  type = object({
    srv_name      = optional(string, "keycloak")
    vm_count      = optional(number, 2)
    flavor        = optional(string, "m1.medium")
    boot_vol_size = optional(number, 30)
    # 'anti-affinity' is hard: the scheduler fails instead of co-locating the
    # instances. 'soft-anti-affinity' only expresses a preference
    affinity_policy = optional(string, "anti-affinity")
    # Ports the service listens on
    https_port      = optional(number, 9443)
    management_port = optional(number, 9000)
  })
  default = {}
}

variable "keycloak_ip" {
  type        = list(string)
  description = "Addresses of the instances on the main private network, one per instance"
  validation {
    condition     = length(var.keycloak_ip) >= var.keycloak_data.vm_count
    error_message = "keycloak_ip must contain at least vm_count addresses."
  }
}

# Data that comes from the network/DNS and project setup workspaces
variable "main_private_network_id" {
  type        = string
  description = "ID of the main private network of the project"
}

variable "main_private_subnet_id" {
  type        = string
  description = "ID of the main private subnet of the project"
}

variable "default_security_group_id" {
  type        = string
  description = "ID of the 'default_for_all' security group of the project"
}

variable "haproxy_l7_ip" {
  type        = list(string)
  description = "Addresses of the L7 HAPROXY load balancers, allowed to reach the service"
}

variable "prometheus_cidr" {
  type        = string
  description = "Address of the Prometheus server, allowed to scrape the management port"
}

# Data that comes from the postgresql workspace
variable "postgresql_network_id" {
  type        = string
  description = "ID of the dedicated network of the PostgreSQL service"
}

variable "postgresql_subnet_id" {
  type        = string
  description = "ID of the dedicated subnet of the PostgreSQL service"
}

variable "postgresql_client_security_group_id" {
  type        = string
  description = "Security group that allows the connections to the PostgreSQL service"
}

variable "availability_zone" {
  type        = string
  description = "Availability zone hint of the instances"
}

variable "image" {
  description = "Image of the instances: uuid and cloud-init user data file"
  type = object({
    uuid           = string
    user_data_file = string
  })
}

variable "ssh_key_name" {
  type        = string
  description = "Name of the SSH key pair injected by cloud-init"
}

# Optional CNAMEs pointing to the load balancer that publishes the service
variable "dns_zone_id" {
  type        = string
  default     = ""
  description = "ID of the DNS zone. Required when keycloak_recordsets is not empty"
}

variable "keycloak_cname_target" {
  type        = string
  default     = ""
  description = "Target of the CNAMEs, usually the name of the main load balancer, with the trailing dot"
}

variable "keycloak_recordsets" {
  description = "CNAMEs that publish the service through the load balancer"
  type = map(object({
    name        = string
    description = string
  }))
  default = {}
}