terraform {
  required_version = ">= 1.7, < 2.0"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 6.0" }
  }
}

variable "region" {
  type = string
}
variable "account_id" {
  type = string
}
variable "vpc_id" {
  type = string
}

provider "aws" {
  region              = var.region
  allowed_account_ids = [var.account_id]
}

# Own groups separately from their directed rules. Do not add inline rules.
resource "aws_security_group" "api" {
  name_prefix = "cycle-lab-api-"
  description = "Orders API TLS"
  vpc_id      = var.vpc_id
  tags        = { Environment = "staging", Team = "commerce" }
}

resource "aws_security_group" "worker" {
  name_prefix = "cycle-lab-worker-"
  description = "Orders worker callback TLS"
  vpc_id      = var.vpc_id
  tags        = { Environment = "staging", Team = "commerce" }
}

resource "aws_vpc_security_group_ingress_rule" "api_from_worker" {
  security_group_id            = aws_security_group.api.id
  referenced_security_group_id = aws_security_group.worker.id
  ip_protocol                  = "tcp"
  from_port                    = 8443
  to_port                      = 8443
  description                  = "Worker calls API"
}

resource "aws_vpc_security_group_egress_rule" "worker_to_api" {
  security_group_id            = aws_security_group.worker.id
  referenced_security_group_id = aws_security_group.api.id
  ip_protocol                  = "tcp"
  from_port                    = 8443
  to_port                      = 8443
  description                  = "Worker calls API"
}

resource "aws_vpc_security_group_ingress_rule" "worker_from_api" {
  security_group_id            = aws_security_group.worker.id
  referenced_security_group_id = aws_security_group.api.id
  ip_protocol                  = "tcp"
  from_port                    = 8443
  to_port                      = 8443
  description                  = "API calls worker callback endpoint"
}

resource "aws_vpc_security_group_egress_rule" "api_to_worker" {
  security_group_id            = aws_security_group.api.id
  referenced_security_group_id = aws_security_group.worker.id
  ip_protocol                  = "tcp"
  from_port                    = 8443
  to_port                      = 8443
  description                  = "API calls worker callback endpoint"
}

output "security_group_ids" {
  value = {
    api    = aws_security_group.api.id
    worker = aws_security_group.worker.id
  }
}