resource "aws_network_acl" "public" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.public_subnets

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-public-nacl"
  })
}

resource "aws_network_acl" "supabase_private" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = slice(module.vpc.private_subnets, 0, 2)

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-supabase-private-nacl"
  })
}

resource "aws_network_acl" "waterwheel_private" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = slice(module.vpc.private_subnets, 2, 4)

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-waterwheel-private-nacl"
  })
}

resource "aws_network_acl" "qwen_private" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = slice(module.vpc.private_subnets, 4, 6)

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-qwen-private-nacl"
  })
}

resource "aws_network_acl" "lambda_private" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = slice(module.vpc.private_subnets, 6, length(module.vpc.private_subnets))

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-lambda-private-nacl"
  })
}

resource "aws_network_acl" "db_private" {
  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.database_subnets

  ingress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  egress {
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    protocol   = "-1"
    from_port  = 0
    to_port    = 0
  }

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-db-private-nacl"
  })
}