locals {
  common_labels = {
    application = "watermaps"
    managed_by  = "opentofu"
  }
}

resource "hcloud_ssh_key" "deploy" {
  name       = "${var.server_name}-deploy"
  public_key = trimspace(var.ssh_public_key)
  labels     = local.common_labels
}

resource "hcloud_primary_ip" "main" {
  name              = "${var.server_name}-ipv4"
  location          = var.location
  type              = "ipv4"
  auto_delete       = false
  delete_protection = var.enable_primary_ip_protection
  labels            = local.common_labels

  lifecycle {
    prevent_destroy = true
  }
}

resource "hcloud_firewall" "main" {
  name   = "${var.server_name}-firewall"
  labels = local.common_labels

  rule {
    description = "SSH from configured administrator networks"
    direction   = "in"
    protocol    = "tcp"
    port        = "22"
    source_ips  = var.admin_cidrs
  }

  rule {
    description = "HTTP for ACME challenge and HTTPS redirect"
    direction   = "in"
    protocol    = "tcp"
    port        = "80"
    source_ips = [
      "0.0.0.0/0",
      "::/0",
    ]
  }

  rule {
    description = "HTTPS"
    direction   = "in"
    protocol    = "tcp"
    port        = "443"
    source_ips = [
      "0.0.0.0/0",
      "::/0",
    ]
  }

  rule {
    description = "ICMP diagnostics"
    direction   = "in"
    protocol    = "icmp"
    source_ips = [
      "0.0.0.0/0",
      "::/0",
    ]
  }
}

resource "hcloud_server" "main" {
  name        = var.server_name
  image       = "ubuntu-24.04"
  server_type = var.server_type
  location    = var.location

  ssh_keys     = [hcloud_ssh_key.deploy.id]
  firewall_ids = [hcloud_firewall.main.id]

  user_data = templatefile("${path.module}/cloud-init.yaml.tftpl", {
    deploy_user                     = var.deploy_user
    ssh_public_key                  = jsonencode(trimspace(var.ssh_public_key))
    routing_volume_id               = hcloud_volume.routing_data.id
    initialize_empty_routing_volume = var.initialize_empty_routing_volume
  })

  public_net {
    ipv4_enabled = true
    ipv4         = hcloud_primary_ip.main.id
    ipv6_enabled = false
  }

  delete_protection        = var.enable_server_protection
  rebuild_protection       = var.enable_server_protection
  shutdown_before_deletion = true

  labels = local.common_labels
}

resource "hcloud_volume" "routing_data" {
  name              = "${var.server_name}-routing-data"
  location          = var.location
  size              = var.routing_volume_size_gb
  delete_protection = var.enable_volume_protection
  labels            = local.common_labels

  lifecycle {
    prevent_destroy = true
  }
}

resource "hcloud_volume_attachment" "routing_data" {
  volume_id = hcloud_volume.routing_data.id
  server_id = hcloud_server.main.id
  automount = false
}