locals {
  account_id              = "${data.aws_caller_identity.current_identity.account_id}"
  region                  = "${data.aws_region.current_region.name}"
  vpc_id                  = "${data.aws_vpc.current_vpc.id}"
  private_subnet_ids      = "${sort(data.aws_subnets.private_subnets.ids)}"

  common_tags = {
    short_name  = "${var.short_name}"
    owner_email = "${var.owner_email}"
    owner_name  = "${var.owner_name}"
    "coxauto:ci-id" = var.ciid
  }
}

resource "alks_iamrole" "codebuild_role" {
  tags = {"coxauto:ci-id" = var.ciid}

  name                     = "${var.short_name}-codebuild"
  type                     = "AWS CodeBuild"
  include_default_policies = true
}

resource "aws_iam_role_policy" "codebuild_policy_logs" {
  name = "codebuild-policy-logs"
  role = "${alks_iamrole.codebuild_role.name}"

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": [
        "arn:aws:logs:*:${local.account_id}:log-group:/aws/codebuild/*"
      ],
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ]
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy" "codebuild_vpc_policy" {
  name = "codebuild-policy-vpc"
  role = "${alks_iamrole.codebuild_role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterfacePermission"
            ],
            "Resource": "arn:aws:ec2:*:${local.account_id}:network-interface/*"
        }
    ]
}
POLICY
}

resource "aws_iam_role_policy" "codebuild_policy_ecr" {
  name = "codebuild-policy-ecr"
  role = "${alks_iamrole.codebuild_role.name}"

  policy = <<POLICY
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:PutImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": [
                "arn:aws:ecr:*:${local.account_id}:repository/${var.short_name}",
                "arn:aws:ecr:*:${local.account_id}:repository/${var.short_name}-integration"
            ]
        },
        {
            "Effect": "Allow",
            "Action": ["ecr:GetAuthorizationToken"],
            "Resource": "*"
        }
    ]
}
POLICY
}

resource "aws_codebuild_project" "codebuild_project" {
  name          = "${var.short_name}"
  description   = "short_name: ${var.short_name}"
  build_timeout = "20"
  service_role  = "${alks_iamrole.codebuild_role.arn}"

  artifacts {
    type           = "NO_ARTIFACTS"
  }

  environment {
    compute_type    = "BUILD_GENERAL1_SMALL"
    image           = "${var.docker_build_image}"
    type            = "LINUX_CONTAINER"
    privileged_mode = true
  }

  source {
    type      = "GITHUB_ENTERPRISE"
    location  = "${var.git_repo_url}"
    buildspec = "${var.build_spec_file}"

  }

  vpc_config {
    vpc_id = "${local.vpc_id}"

    subnets = local.private_subnet_ids

    security_group_ids = [
      "${aws_security_group.security-group.id}",
    ]
  }

  tags = "${local.common_tags}"
}

resource "aws_codebuild_source_credential" "creds" {
  auth_type = "PERSONAL_ACCESS_TOKEN"
  server_type = "GITHUB_ENTERPRISE"
  token = data.aws_secretsmanager_secret_version.current.secret_string
}


resource "aws_security_group" "security-group" {
  name        = "${var.short_name}-codebuild"
  description = "Allow all inbound 172 traffic, anywhere out"
  vpc_id      = "${local.vpc_id}"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "tcp"
    cidr_blocks = ["172.0.0.0/8"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = "${local.common_tags}"
}