locals {
  csp_directives = join("", [
    "default-src 'self';",
    "script-src 'self';",
    "style-src 'self' 'unsafe-inline';",
    "img-src 'self' data: https://storage.googleapis.com;",
    "font-src 'self';",
    "connect-src 'self';",
    "frame-src 'self' blob: https://storage.googleapis.com;",
    "frame-ancestors 'self';",
    "object-src 'none';",
    "base-uri 'self';",
    "form-action 'self' https://accounts.google.com https://login.microsoftonline.com;",
    "upgrade-insecure-requests",
  ])

  security_response_headers = [
    "Strict-Transport-Security: max-age=31536000; includeSubDomains",
    "Content-Security-Policy: ${local.csp_directives}",
    "X-Content-Type-Options: nosniff",
    "Referrer-Policy: strict-origin-when-cross-origin",
    "Permissions-Policy: geolocation=(self), microphone=(), camera=()",
  ]
}

# Backend Service for the API
resource "google_compute_backend_service" "variable_api" {
  name = "backend-service-variable-api"

  log_config {
    enable = true
  }

  backend {
    group = google_compute_region_network_endpoint_group.variable_api.id
  }
}

# Backend Service for the UI (nginx container, e.g. on Cloud Run)
resource "google_compute_backend_service" "variable_ui" {
  name = "backend-service-variable-ui"

  custom_response_headers = local.security_response_headers

  log_config {
    enable = true
  }

  enable_cdn = true
  cdn_policy {
    # USE_ORIGIN_HEADERS only caches responses the origin explicitly marks
    # cacheable via Cache-Control, so dynamic HTML is not cached while
    # the content-hashed static assets served by nginx are.
    cache_mode = "USE_ORIGIN_HEADERS"

    # Negative caching off: the UI uses try_files $uri /index.html so 404
    # is effectively impossible, and we do not want transient 5xx from
    # cold starts or deploys cached at the edge.
    negative_caching = false

    # Content-hashed asset filenames already make the cache key unique
    # per asset version, so query strings would only fragment the cache.
    cache_key_policy {
      include_host         = true
      include_protocol     = true
      include_query_string = false
    }
  }

  backend {
    group = google_compute_region_network_endpoint_group.variable_ui.id
  }
}

# Backend Bucket for uploads
resource "google_compute_backend_bucket" "variable_uploads" {
  name        = "backend-service-variable-uploads"
  bucket_name = google_storage_bucket.variable_uploads.name
  enable_cdn  = true

  cdn_policy {
    cache_mode = "CACHE_ALL_STATIC"
  }
}

# URL Map for the Variable application
resource "google_compute_url_map" "variable" {
  name        = "url-map-variable"
  description = "Maps the incoming request to either the UI container or the API on /api routes."

  default_service = google_compute_backend_service.variable_ui.id

  host_rule {
    hosts        = ["*"]
    path_matcher = "all"
  }

  path_matcher {
    name            = "all"
    default_service = google_compute_backend_service.variable_ui.id

    path_rule {
      paths   = ["/api", "/api/*"]
      service = google_compute_backend_service.variable_api.id
    }

    path_rule {
      paths   = ["/uploads", "/uploads/*"]
      service = google_compute_backend_bucket.variable_uploads.id
    }
  }
}

resource "google_compute_target_https_proxy" "variable" {
  name    = "ssl-lb-variable"
  url_map = google_compute_url_map.variable.id
  certificate_map = "..."
}

resource "google_cloud_run_service" "variable_ui" {
  name     = "variable-ui"
  location = var.region

  autogenerate_revision_name = true

  template {
    spec {
      containers {
        resources {
          limits = {
            cpu    = "1000m"
            memory = "512Mi"
          }
        }
        image = "gcr.io/.../variable-ui:latest" # TODO: Update with the actual image URL
      }
    }
  }
}

resource "google_cloud_run_service_iam_member" "variable_ui_public" {
  location = google_cloud_run_service.variable_ui.location
  service  = google_cloud_run_service.variable_ui.name
  role     = "roles/run.invoker"
  member   = "allUsers"
}

resource "google_compute_region_network_endpoint_group" "variable_ui" {
  name                  = "neg-variable-ui"
  region                = var.region
  network_endpoint_type = "SERVERLESS"

  cloud_run {
    service = google_cloud_run_service.variable_ui.name
  }
}

resource "google_storage_bucket" "public_uploads_read" {
  name     = "public-uploads-read"
  location = var.europe

  versioning { enabled = true }

  website {
    main_page_suffix = "index.html"
    not_found_page   = "index.html"
  }
}

resource "google_storage_bucket" "public_uploads_write" {
  name     = "public-uploads-write"
  location = var.region

  public_access_prevention = "enforced"

  versioning { enabled = true }
}

resource "google_storage_bucket" "private_uploads_read" {
  name     = "private-uploads-read"
  location = var.europe
  project  = var.project_id

  public_access_prevention = "enforced"

  versioning { enabled = true }
}

resource "google_storage_bucket" "private_uploads_write" {
  name     = "private-uploads-write"
  location = var.region

  public_access_prevention = "enforced"

  versioning { enabled = true }
}

resource "google_cloud_run_service" "variable_api" {
  name     = "variable-api"
  location = var.region

  autogenerate_revision_name = true

  template {
    spec {
      containers {
        resources {
          limits = {
            cpu    = "4000m"
            memory = "4Gi"
          }
        }
        image = "gcr.io/.../variable-api:latest" # TODO: Update with the actual image URL
      }
    }
  }
}

module "gce-container" {
  source  = "terraform-google-modules/container-vm/google"
  version = "~> 3.0"

  container = {
    image = "docker.io/neo4j:5.26.31"

    env = [
      {
        name  = "NEO4J_db_transaction_timeout"
        value = "120s"
      },
      {
        name  = "NEO4J_dbms_security_procedures_allowlist"
        value = "apoc.*"
      },
      {
        name  = "NEO4J_dbms_security_procedures_unrestricted"
        value = "apoc.*"
      },
      {
        name  = "NEO4J_server_default__listen__address"
        value = "0.0.0.0"
      },
      {
        name  = "NEO4J_server_bolt_listen__address"
        value = "0.0.0.0:7687"
      },
      {
        name  = "NEO4J_server_http_listen__address"
        value = "0.0.0.0:7474"
      },
      {
        name  = "NEO4J_apoc_export_file_enabled"
        value = "true"
      },
      {
        name  = "NEO4J_apoc_import_file_enabled"
        value = "true"
      },
      {
        name  = "NEO4J_apoc_import_file_use__neo4j__config"
        value = "true"
      },
      {
        name  = "NEO4J_apoc_trigger_enabled"
        value = "true"
      },
      {
        name  = "NEO4J_dbms_cypher_lenient__create__relationship"
        value = "true"
      },
      {
        name  = "NEO4J_PLUGINS"
        value = "[\"apoc\"]"
      },
      {
        name  = "NEO4J_AUTH"
        value = "neo4j/<your-password>"
      },
    ]

    # APOC Core ships inside the Neo4j 5.x image - no separate plugin disk needed.
    volumeMounts = [
      {
        mountPath = "/cache"
        name      = "tempfs-0"
        readOnly  = false
      },
      {
        mountPath = "/data"
        name      = "data-disk-0"
        readOnly  = false
      },
    ]
  }

  volumes = [
    {
      name = "tempfs-0"

      emptyDir = {
        medium = "Memory"
      }
    },
    {
      name = "data-disk-0"

      gcePersistentDisk = {
        pdName = "data-disk-0"
        fsType = "ext4"
      }
    },
  ]

  restart_policy = "Always"
}

resource "google_compute_disk" "pd_neo4j" {
  name     = "neo4j-data-disk"
  zone     = var.zone
  type     = "pd-ssd" # SSD persistent disk
  size     = 25
}

resource "google_compute_instance" "neo4j_vm" {
  name = "neo4j"
  machine_type = "n2-standard-8"
  zone         = var.zone

  shielded_instance_config {
    enable_secure_boot = true
  }
  allow_stopping_for_update = false

  scheduling {
    provisioning_model = "STANDARD"
    preemptible        = false
    automatic_restart  = true

    instance_termination_action = null
  }

  boot_disk {
    initialize_params {
      size  = 10
      image = module.gce-container.source_image
    }
  }

  attached_disk {
    source      = google_compute_disk.pd_neo4j.self_link
    device_name = "data-disk-0"
    mode        = "READ_WRITE"
  }

  network_interface {
    subnetwork = module.vpc-module.subnets["${var.region}/serverless-subnet"].name
    network_ip = google_compute_address.neo4j.address
  }

  metadata = {
    gce-container-declaration = module.gce-container.metadata_value
    google-logging-enabled    = true
    block-project-ssh-keys    = true
  }

  labels = {
    container-vm = module.gce-container.vm_container_label
  }

  tags = ["neo4j-instance"]

  service_account {
    email  = google_service_account.neo4j.email
    scopes = ["cloud-platform"]
  }
}

resource "google_compute_address" "neo4j" {
  name         = "int-ip-neo4j"
  description  = "The IP address used for the Neo4j VM in the network."
  address_type = "INTERNAL"
  address      = "..."
}