main.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>4.35"
    }
    azuread = {
      source  = "hashicorp/azuread"
      version = "~>3.0"
    }
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~>5.0"
    }
    dns = {
      source  = "hashicorp/dns"
      version = "~>3.4"
    }
    acme = {
      source  = "vancluever/acme"
      version = "~>2.32"
    }
    tls = {
      source  = "hashicorp/tls"
      version = "~>4.0"
    }
    mailgun = {
      source  = "wgebis/mailgun"
      version = "~>0.7"
    }
    postgresql = {
      source  = "cyrilgdn/postgresql"
      version = "~>1.13"
    }
  }
  backend "azurerm" {
    container_name       = "tfstate"
    key                  = "terraform.tfstate"
    resource_group_name  = "terraform-state"
    storage_account_name = "tikprodterraform"
  }
}

provider "azurerm" {
  features {}
  subscription_id = "3aa1704b-82a5-478f-bc57-2cf4f0876a5e"
}

provider "azuread" {
}

provider "dns" {
}

provider "acme" {
  server_url = "https://acme-v02.api.letsencrypt.org/directory"
}

provider "mailgun" {
  api_key = module.keyvault.secrets["mailgun-terraform-api-key"]
}

provider "cloudflare" {
  api_token = module.keyvault.secrets["cloudflare-api-token"]
}

provider "postgresql" {
  host      = module.common.postgres_server_fqdn
  port      = 5432
  username  = module.common.postgres_admin_username
  password  = module.common.postgres_admin_password
  sslmode   = "require"
  superuser = false
}


locals {
  resource_group_location = "northeurope"
}

module "keyvault" {
  source                  = "./modules/keyvault"
  env_name                = "prod"
  resource_group_name     = module.common.resource_group_name
  resource_group_location = local.resource_group_location
  keyvault_secrets = [
    "digitransit-subscription-key",
    "ilmo-auth-jwt-secret",
    "ilmo-edit-token-secret",
    "ilmo-mailgun-api-key",
    "ilmo-mailgun-domain",
    "ilmo-stripe-api-key",
    "ilmo-stripe-webhook-secret",
    "ilmo-staging-stripe-api-key",
    "ilmo-staging-stripe-webhook-secret",
    "invoice-mailgun-api-key",
    "tikjob-ghost-mail-username",
    "tikjob-ghost-mail-password",
    "tenttiarkisto-django-secret-key",
    "github-app-key",
    "google-oauth-client-id",
    "google-oauth-client-secret",
    "muistinnollaus-smtp-email",
    "muistinnollaus-smtp-password",
    "muistinnollaus-strapi-token",
    "muistinnollaus-paytrail-merchant-id",
    "muistinnollaus-paytrail-secret-key",
    "mongodb-atlas-public-key",
    "mongodb-atlas-private-key",
    "github-challenge-value",
    "mailgun-sender",
    "mailgun-receiver",
    "mailgun-api-key",
    "mailgun-domain",
    "mailgun-url",
    "oldweb-ghcr-access-token",
    "tikjob-tg-bot-token",
    "tikjob-tg-ghost-hook-secret",
    "vaultwarden-api-key",
    "vaultwarden-smtp-username",
    "vaultwarden-smtp-password",
    "status-telegram-token",
    "status-telegram-channel-id",
    "registry-mailgun-api-key",
    "registry-stripe-api-key",
    "registry-stripe-webhook-secret",
    "mailgun-terraform-api-key",
    "cloudflare-api-token",
    "running-challenge-client-id",
    "running-challenge-client-secret",
    "running-challenge-refresh-token"
  ]
}

module "cloudflare" {
  source = "./modules/cloudflare"

  zone_name              = "tietokilta.fi"
  github_challenge_value = module.keyvault.secrets["github-challenge-value"]
  # Hardcoded to avoid circular dependency with modules that consume cloudflare.zone_id
  dmarc_report_domains = [
    "list.tietokilta.fi",
    "list.tietokila.fi",
    "rekry.tietokilta.fi",
    "ilmo.tietokilta.fi",
    "laskutus.tietokilta.fi",
    "vaalit.tietokilta.fi",
    "rekisteri.tietokilta.fi",
  ]
}

module "dns_prod" {
  source                  = "./modules/dns/root"
  env_name                = "prod"
  resource_group_location = local.resource_group_location
  zone_name               = "tietokilta.fi"
}

module "dns_staging" {
  source                  = "./modules/dns/root"
  env_name                = "staging"
  resource_group_location = local.resource_group_location
  zone_name               = "tietokila.fi"
}
module "dns_m0" {
  source                  = "./modules/dns/root"
  env_name                = "m0"
  resource_group_location = local.resource_group_location
  zone_name               = "muistinnollaus.fi"
}
module "dns_juvusivu" {
  source                  = "./modules/dns/root"
  env_name                = "juvu"
  resource_group_location = local.resource_group_location
  zone_name               = "juhlavuosi.fi"
}
module "tenttiarkisto_dns_zone" {
  source                  = "./modules/dns/root"
  env_name                = "prod"
  resource_group_location = module.common.resource_group_location
  # legacy due to previous setup
  resource_group_name = module.common.resource_group_name
  zone_name           = "tenttiarkisto.fi"
}
module "dns_github" {
  source = "./modules/dns/github"

  resource_group_name = module.dns_prod.resource_group_name
  zone_name           = module.dns_prod.root_zone_name
  challenge_name      = "_github-challenge-Tietokilta-org"
  challenge_value     = module.keyvault.secrets["github-challenge-value"]

}
# Cloudflare zone lookups for non-tietokilta.fi domains
data "cloudflare_zone" "juvusivu" {
  filter = {
    name = "juhlavuosi.fi"
  }
}
data "cloudflare_zone" "m0" {
  filter = {
    name = "muistinnollaus.fi"
  }
}
data "cloudflare_zone" "staging" {
  filter = {
    name = "tietokila.fi"
  }
}
data "cloudflare_zone" "tenttiarkisto" {
  filter = {
    name = "tenttiarkisto.fi"
  }
}

module "mailman" {
  source = "./modules/dns/mailman"

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "list"
  cloudflare_zone_id      = module.cloudflare.zone_id

  dkim_selector = "mta"
  dkim_key      = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJN6WyS7YQcOKO4MKsSbrYfjL8hh24ot/0uQysHte3eqscbbwCFVlgmsg3423by3e20ZSBMhRXdtIkYdgn8wkfPyZlHVEOvOJBCR+tKqtexxQEbkk8LqmEzVggNZoLLX06wYNqt2Nxl++dlvUuB4IxmPPGQed3Xr7HBT8OZmKJYQIDAQAB"
}

module "mailing_staging" {
  source = "./modules/dns/mailing"

  dns_resource_group_name = module.dns_staging.resource_group_name
  root_zone_name          = module.dns_staging.root_zone_name
  subdomain               = "list"
  cloudflare_zone_id      = data.cloudflare_zone.staging.id

  dkim_selector = "mg"
  dkim_key      = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZGR9aFa3+4SaHMkvO44EzQzbmMPEYqryH1tsgBlNErA5Qd/UNtCgQ+vy1uO2SyOGZDoD6xEDVZ8Mqh4JXXX3GVvEgpESjSlj+RkhCLY9JGVJwkgVWTUD65qkLJ9NpADBMQUhzJgxIv+It3zxbFDUOmLv2+Qee7d/MR1Gfgn/wNwIDAQAB"
}

module "dns_misc_prod" {
  source                  = "./modules/dns/prod"
  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name

  dmarc_report_domains = [
    module.mailman.fqdn,
    module.mailing_staging.fqdn,
    module.tikjob_app.fqdn,
    module.ilmo.fqdn,
    module.invoicing.fqdn,
    module.discourse.fqdn,
    module.registry.fqdn,
  ]
}

module "common" {
  source                  = "./modules/common"
  env_name                = "prod"
  resource_group_location = local.resource_group_location
}
resource "azurerm_key_vault_secret" "postgres_admin_user" {
  name         = "postgres-admin-user"
  value        = module.common.postgres_admin_username
  key_vault_id = module.keyvault.keyvault_id
}
resource "azurerm_key_vault_secret" "postgres_admin_password" {
  name         = "postgres-admin-password"
  value        = module.common.postgres_admin_password
  key_vault_id = module.keyvault.keyvault_id
}
resource "azurerm_key_vault_secret" "postgres_backup_user" {
  name         = "postgres-backup-user"
  value        = module.common.postgres_backup_username
  key_vault_id = module.keyvault.keyvault_id
}
resource "azurerm_key_vault_secret" "postgres_backup_password" {
  name         = "postgres-backup-password"
  value        = module.common.postgres_backup_password
  key_vault_id = module.keyvault.keyvault_id
}

module "mongodb" {
  source                    = "./modules/mongodb"
  mongodb_atlas_public_key  = module.keyvault.secrets["mongodb-atlas-public-key"]
  mongodb_atlas_private_key = module.keyvault.secrets["mongodb-atlas-private-key"]
  cluster_name              = "tikweb-serverless-instance"
  project_name              = "tikweb-${terraform.workspace}"
  atlas_region              = "EUROPE_WEST"
}

resource "azurerm_key_vault_secret" "mongo_db_connection_string" {
  name         = "mongo-db-connection-string"
  value        = module.mongodb.db_connection_string
  key_vault_id = module.keyvault.keyvault_id
}

module "web" {
  source                       = "./modules/web"
  resource_group_location      = local.resource_group_location
  resource_group_name          = module.common.resource_group_name
  app_service_plan_id          = module.common.tikweb_app_plan_id
  acme_account_key             = module.common.acme_account_key
  root_zone_name               = module.dns_prod.root_zone_name
  dns_resource_group_name      = module.dns_prod.resource_group_name
  subdomain                    = "@"
  environment                  = "prod"
  mongo_connection_string      = "${module.mongodb.db_connection_string}/payload?retryWrites=true&w=majority"
  google_oauth_client_id       = module.keyvault.secrets["google-oauth-client-id"]
  google_oauth_client_secret   = module.keyvault.secrets["google-oauth-client-secret"]
  public_ilmo_url              = "https://${module.ilmo.fqdn}"
  public_laskugeneraattori_url = "https://${module.invoicing.fqdn}"
  public_legacy_url            = "https://${module.oldweb.fqdn}"
  digitransit_subscription_key = module.keyvault.secrets["digitransit-subscription-key"]
  mailgun_sender               = module.keyvault.secrets["mailgun-sender"]
  mailgun_receiver             = module.keyvault.secrets["mailgun-receiver"]
  mailgun_api_key              = module.keyvault.secrets["mailgun-api-key"]
  mailgun_domain               = module.keyvault.secrets["mailgun-domain"]
  mailgun_url                  = module.keyvault.secrets["mailgun-url"]
  cloudflare_zone_id           = module.cloudflare.zone_id
  cloudflare_api_token         = module.keyvault.secrets["cloudflare-api-token"]
}

resource "azurerm_key_vault_secret" "cms_password" {
  name         = "cms-password"
  value        = module.web.payload_password
  key_vault_id = module.keyvault.keyvault_id
}
module "ilmo" {
  source                = "./modules/ilmo"
  environment           = "prod"
  tikweb_rg_name        = module.common.resource_group_name
  tikweb_rg_location    = module.common.resource_group_location
  tikweb_app_plan_id    = module.common.tikweb_app_plan_id
  postgres_server_fqdn  = module.common.postgres_server_fqdn
  postgres_server_id    = module.common.postgres_server_id
  edit_token_secret     = module.keyvault.secrets["ilmo-edit-token-secret"]
  auth_jwt_secret       = module.keyvault.secrets["ilmo-auth-jwt-secret"]
  mailgun_api_key       = module.keyvault.secrets["ilmo-mailgun-api-key"]
  stripe_secret_key     = module.keyvault.secrets["ilmo-stripe-api-key"]
  stripe_webhook_secret = module.keyvault.secrets["ilmo-stripe-webhook-secret"]
  website_url           = "https://tietokilta.fi"
  extra_frontends = {
    "juhlavuosi.fi" = {
      eventDetailsUrl    = "https://juhlavuosi.fi/{lang}/events/{slug}"
      editSignupUrl      = "https://juhlavuosi.fi/{lang}/signups/{id}/{editToken}"
      completePaymentUrl = "https://juhlavuosi.fi/{lang}/payment/{id}/{editToken}"
    }
  }

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "ilmo"
  acme_account_key        = module.common.acme_account_key
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "ilmo_staging" {
  source                = "./modules/ilmo_staging"
  environment           = "staging"
  tikweb_rg_name        = module.common.resource_group_name
  tikweb_rg_location    = module.common.resource_group_location
  tikweb_app_plan_id    = module.common.tikweb_app_plan_id
  postgres_server_fqdn  = module.common.postgres_server_fqdn
  postgres_server_id    = module.common.postgres_server_id
  edit_token_secret     = module.keyvault.secrets["ilmo-edit-token-secret"]
  auth_jwt_secret       = module.keyvault.secrets["ilmo-auth-jwt-secret"]
  mailgun_api_key       = module.keyvault.secrets["ilmo-mailgun-api-key"]
  mailgun_domain        = module.keyvault.secrets["ilmo-mailgun-domain"]
  stripe_secret_key     = module.keyvault.secrets["ilmo-staging-stripe-api-key"]
  stripe_webhook_secret = module.keyvault.secrets["ilmo-staging-stripe-webhook-secret"]
  website_url           = "https://tietokilta.fi"
}

module "histotik" {
  source                  = "./modules/histotik"
  env_name                = "prod"
  resource_group_location = local.resource_group_location

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "histotik"
  cloudflare_zone_id      = module.cloudflare.zone_id
}

module "tenttiarkisto" {
  source                       = "./modules/tenttiarkisto"
  env_name                     = "prod"
  postgres_resource_group_name = module.common.resource_group_name
  resource_group_location      = local.resource_group_location
  postgres_server_fqdn         = module.common.postgres_server_fqdn
  postgres_server_id           = module.common.postgres_server_id
  tikweb_app_plan_id           = module.common.tikweb_app_plan_id
  tikweb_app_plan_rg_location  = module.common.resource_group_location
  tikweb_app_plan_rg_name      = module.common.resource_group_name
  django_secret_key            = module.keyvault.secrets["tenttiarkisto-django-secret-key"]
  acme_account_key             = module.common.acme_account_key
  dns_resource_group_name      = module.tenttiarkisto_dns_zone.resource_group_name
  root_zone_name               = module.tenttiarkisto_dns_zone.root_zone_name
  cloudflare_zone_id           = data.cloudflare_zone.tenttiarkisto.id
  cloudflare_api_token         = module.keyvault.secrets["cloudflare-api-token"]
}

module "voo" {
  source                  = "./modules/voo"
  env_name                = "prod"
  resource_group_location = local.resource_group_location
}

module "tikjob_storage" {
  source                  = "./modules/recruiting/storage"
  env_name                = "prod"
  resource_group_location = local.resource_group_location
  ghost_db_username       = "tikrekryadmin"
}

module "tikjob_app" {
  source = "./modules/recruiting/ghost"

  environment        = "prod"
  tikweb_app_plan_id = module.common.tikweb_app_plan_id
  tikweb_rg_name     = module.common.resource_group_name
  tikweb_rg_location = module.common.resource_group_location

  mysql_db_name  = module.tikjob_storage.mysql_db_name
  mysql_fqdn     = module.tikjob_storage.mysql_fqdn
  mysql_username = module.tikjob_storage.mysql_username
  mysql_password = module.tikjob_storage.mysql_password

  storage_account_name = module.tikjob_storage.storage_account_name
  storage_account_key  = module.tikjob_storage.storage_account_key
  storage_share_name   = module.tikjob_storage.storage_share_name

  ghost_mail_host     = "smtp.eu.mailgun.org"
  ghost_mail_port     = 465
  ghost_mail_username = module.keyvault.secrets["tikjob-ghost-mail-username"]
  ghost_mail_password = module.keyvault.secrets["tikjob-ghost-mail-password"]

  acme_account_key = module.common.acme_account_key

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "rekry"
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "tikjob_tg_bot" {
  source = "./modules/recruiting/tg-bot"

  env_name                   = "prod"
  tikweb_rg_name             = module.common.resource_group_name
  tikweb_rg_location         = local.resource_group_location
  tikweb_app_plan_id         = module.common.tikweb_app_plan_id
  storage_account_name       = module.tikjob_storage.storage_account_name
  storage_account_access_key = module.tikjob_storage.storage_account_key
  bot_token                  = module.keyvault.secrets["tikjob-tg-bot-token"]
  ghost_hook_secret          = module.keyvault.secrets["tikjob-tg-ghost-hook-secret"]
  channel_id                 = "-1001347398697"
}

module "discourse" {
  source = "./modules/discourse"

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "vaalit"
  discourse_ip            = "46.62.222.17"
  cloudflare_zone_id      = module.cloudflare.zone_id

  dkim_selector = "mta"
  dkim_key      = "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzppfPnLHshnORT2P0C3OBuo80OCsCOpLHQS2txfRq2k+y+P4rocFy4z1H0397Ijy6wKM+VI3qOnc8RzVkaZib8+p08jBf/O/hxTwTkuMrotdIo2zrfBq+T1AaYMj4zNJnPt10+vLptpEA6m0XIWsu7wTRE6WfqHjlHj7CwkhTzwIDAQAB"
}

module "tikpannu" {
  source = "./modules/tikpannu"

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "pannu"
  tikpannu_ip             = "46.62.222.17"
  cloudflare_zone_id      = module.cloudflare.zone_id
}

module "invoicing" {
  source = "./modules/invoicing"

  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "laskutus"

  mailgun_api_key         = module.keyvault.secrets["invoice-mailgun-api-key"]
  resource_group_location = local.resource_group_location
  resource_group_name     = module.common.resource_group_name
  app_service_plan_id     = module.common.tikweb_app_plan_id
  acme_account_key        = module.common.acme_account_key
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "registry" {
  source                  = "./modules/registry"
  resource_group_location = local.resource_group_location
  resource_group_name     = module.common.resource_group_name
  app_service_plan_id     = module.common.tikweb_app_plan_id
  postgres_server_id      = module.common.postgres_server_id
  postgres_server_fqdn    = module.common.postgres_server_fqdn
  environment             = "prod"
  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "rekisteri"
  acme_account_key        = module.common.acme_account_key
  mailgun_api_key         = module.keyvault.secrets["registry-mailgun-api-key"]
  stripe_api_key          = module.keyvault.secrets["registry-stripe-api-key"]
  stripe_webhook_secret   = module.keyvault.secrets["registry-stripe-webhook-secret"]
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "oldweb" {
  source                  = "./modules/oldweb"
  environment             = "prod"
  postgres_server_fqdn    = module.common.postgres_server_fqdn
  postgres_server_id      = module.common.postgres_server_id
  dns_resource_group_name = module.dns_prod.resource_group_name
  root_zone_name          = module.dns_prod.root_zone_name
  subdomain               = "old"
  acme_account_key        = module.common.acme_account_key
  tikweb_app_plan_id      = module.common.tikweb_app_plan_id
  tikweb_rg_location      = module.common.resource_group_location
  tikweb_rg_name          = module.common.resource_group_name
  location                = local.resource_group_location
  ghcr_token              = module.keyvault.secrets["oldweb-ghcr-access-token"]
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "vaultwarden" {
  environment                          = "prod"
  source                               = "./modules/vaultwarden"
  admin_api_key                        = module.keyvault.secrets["vaultwarden-api-key"]
  app_service_plan_id                  = module.common.tikweb_app_plan_id
  app_service_plan_location            = local.resource_group_location
  app_service_plan_resource_group_name = module.common.resource_group_name
  db_password                          = module.common.postgres_admin_password
  db_username                          = module.common.postgres_admin_username
  db_name                              = "vaultwarden"
  db_host                              = module.common.postgres_server_fqdn
  location                             = local.resource_group_location
  smtp_host                            = "smtp.eu.mailgun.org"
  vaultwarden_smtp_from                = "vault@tietokilta.fi"
  vaultwarden_smtp_username            = module.keyvault.secrets["vaultwarden-smtp-username"]
  vaultwarden_smtp_password            = module.keyvault.secrets["vaultwarden-smtp-password"]
  dns_resource_group_name              = module.dns_prod.resource_group_name
  acme_account_key                     = module.common.acme_account_key
  root_zone_name                       = module.dns_prod.root_zone_name
  subdomain                            = "vault"
  cloudflare_zone_id                   = module.cloudflare.zone_id
  cloudflare_api_token                 = module.keyvault.secrets["cloudflare-api-token"]
}

module "github-ci-roles" {
  source = "./modules/github-ci"
  repo_app_service_map = {
    "Tietokilta/web" : [module.web.web_app_id]
    "Tietokilta/laskugeneraattori" : [module.invoicing.invoicing_app_id]
    "Tietokilta/ilmomasiina" : [module.ilmo.app_id]
    "Tietokilta/ISOpistekortti" : [module.isopistekortti.app_id]
    "Tietokilta/juvusivu" : [module.juvusivu.juvusivu_app_id]
    "Tietokilta/infra" : [module.status.app_id]
    "Tietokilta/rekisteri" : [module.registry.registry_app_id]
    "Tietokilta/running-challenge" : [module.running_challenge.app_id]
  }
}

module "histotik_github_ci" {
  source     = "./modules/github-ci-role"
  repository = "Tietokilta/histotik"
  subject    = "repo:Tietokilta/histotik:environment:production"
  role_assignments = [
    {
      scope                = module.histotik.storage_account_id
      role_definition_name = "Storage Blob Data Contributor"
    }
  ]
}

module "backup_storage_identity" {
  source = "./modules/backup-storage-identity"
}

# Output Azure Client IDs for Each Repository
output "github_actions_azure_client_ids" {
  description = "Mapping of GitHub repositories to their AZURE_CLIENT_ID"
  value = merge(
    module.github-ci-roles.azure_client_ids,
    { "Tietokilta/histotik" = module.histotik_github_ci.client_id }
  )
}

# Output Azure Subscription ID
output "github_actions_azure_subscription_id" {
  description = "AZURE_SUBSCIPTION_ID in Github Actions"
  value       = module.github-ci-roles.azure_subscription_id
}

# Output Azure Tenant ID
output "github_actions_azure_tenant_id" {
  description = "AZURE_TENANT_ID in Github Actions"
  value       = module.github-ci-roles.azure_tenant_id
}

output "backup_azure_client_id" {
  description = "Client ID for the backup service principal."
  value       = module.backup_storage_identity.client_id
}

output "backup_azure_client_secret" {
  description = "Client secret for the backup service principal."
  value       = module.backup_storage_identity.client_secret
  sensitive   = true
}

output "backup_azure_tenant_id" {
  description = "Tenant ID for the backup service principal."
  value       = module.backup_storage_identity.tenant_id
}

module "juvusivu" {
  source                               = "./modules/juvusivu"
  environment                          = "prod"
  app_service_plan_id                  = module.common.tikweb_app_plan_id
  app_service_plan_location            = local.resource_group_location
  app_service_plan_resource_group_name = module.common.resource_group_name
  location                             = local.resource_group_location
  postgres_server_fqdn                 = module.common.postgres_server_fqdn
  postgres_server_id                   = module.common.postgres_server_id
  acme_account_key                     = module.common.acme_account_key
  dns_resource_group_name              = module.dns_juvusivu.resource_group_name
  root_zone_name                       = module.dns_juvusivu.root_zone_name
  m0_dns_resource_group_name           = module.dns_m0.resource_group_name
  m0_dns_zone_name                     = module.dns_m0.root_zone_name
  cloudflare_zone_id                   = data.cloudflare_zone.juvusivu.id
  cloudflare_m0_zone_id                = data.cloudflare_zone.m0.id
  cloudflare_api_token                 = module.keyvault.secrets["cloudflare-api-token"]
}

module "status" {
  source                               = "./modules/status"
  app_service_plan_id                  = module.common.tikweb_app_plan_id
  app_service_plan_location            = local.resource_group_location
  app_service_plan_resource_group_name = module.common.resource_group_name
  location                             = local.resource_group_location
  dns_resource_group_name              = module.dns_prod.resource_group_name
  acme_account_key                     = module.common.acme_account_key
  root_zone_name                       = module.dns_prod.root_zone_name
  telegram_token                       = module.keyvault.secrets["status-telegram-token"]
  telegram_channel_id                  = "-1003648545192"
  subdomain                            = "status"
  cloudflare_zone_id                   = module.cloudflare.zone_id
  cloudflare_api_token                 = module.keyvault.secrets["cloudflare-api-token"]
}

module "running_challenge" {
  source                  = "./modules/running-challenge"
  resource_group_location = local.resource_group_location
  resource_group_name     = module.common.resource_group_name
  app_service_plan_id     = module.common.tikweb_app_plan_id
  postgres_server_id      = module.common.postgres_server_id
  postgres_server_fqdn    = module.common.postgres_server_fqdn
  subdomain               = "liikuntahaaste"
  root_zone_name          = module.dns_prod.root_zone_name
  dns_resource_group_name = module.dns_prod.resource_group_name
  acme_account_key        = module.common.acme_account_key
  client_id               = module.keyvault.secrets["running-challenge-client-id"]
  client_secret           = module.keyvault.secrets["running-challenge-client-secret"]
  refresh_token           = module.keyvault.secrets["running-challenge-refresh-token"]
  club_id                 = "1997937"
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}

module "isopistekortti" {
  source                  = "./modules/isopistekortti"
  resource_group_location = local.resource_group_location
  resource_group_name     = module.common.resource_group_name
  app_service_plan_id     = module.common.tikweb_app_plan_id
  postgres_server_id      = module.common.postgres_server_id
  postgres_server_fqdn    = module.common.postgres_server_fqdn
  subdomain               = "iso"
  environment             = "prod"
  root_zone_name          = module.dns_prod.root_zone_name
  dns_resource_group_name = module.dns_prod.resource_group_name
  acme_account_key        = module.common.acme_account_key
  cloudflare_zone_id      = module.cloudflare.zone_id
  cloudflare_api_token    = module.keyvault.secrets["cloudflare-api-token"]
}