module "alb-public-sg" {
  source      = "terraform-aws-modules/security-group/aws"
  version     = "~> 5.1.2"
  vpc_id      = module.vpc.vpc_id
  name        = "${var.client_name}-${var.stage}-alb-public-sg"
  description = "${var.client_name}-${var.stage}-alb-public-sg"

  ingress_with_cidr_blocks = [
    {
      rule        = "http-80-tcp"
      description = "Internet-to-ALB-HTTP"
      cidr_blocks = join(",", ["0.0.0.0/0"])
    },
    {
      rule        = "https-443-tcp"
      description = "Internet-to-ALB-HTTPS"
      cidr_blocks = join(",", ["0.0.0.0/0"])
    },
  ]

  egress_rules = ["all-all"]

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-alb-public-sg"
  })
}

module "ec2-private-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 5.1.2"

  vpc_id      = module.vpc.vpc_id
  name        = "${var.client_name}-${var.stage}-ec2-private-sg"
  description = "${var.client_name}-${var.stage}-ec2-private-sg"

  ingress_with_source_security_group_id = [
    {
      rule                     = "http-80-tcp"
      description              = "PublicALB-to-EC2-HTTP"
      source_security_group_id = module.alb-public-sg.security_group_id
    },
    {
      description              = "PublicALB-to-EC2-3000"
      from_port                = 3000
      to_port                  = 3000
      protocol                 = "tcp"
      source_security_group_id = module.alb-public-sg.security_group_id
    },
    {
      description              = "PublicALB-to-EC2-8000"
      from_port                = 8000
      to_port                  = 8000
      protocol                 = "tcp"
      source_security_group_id = module.alb-public-sg.security_group_id
    },
  ]

  egress_rules = ["all-all"]

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-ec2-private-sg"
  })
}

module "rds-proxy-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 5.1.2"

  vpc_id      = module.vpc.vpc_id
  name        = "${var.client_name}-${var.stage}-rds-proxy-sg"
  description = "${var.client_name}-${var.stage}-rds-proxy-sg"

  ingress_with_source_security_group_id = [
    {
      description              = "EC2-to-RDSProxy-5432"
      from_port                = 5432
      to_port                  = 5432
      protocol                 = "tcp"
      source_security_group_id = module.ec2-private-sg.security_group_id
    },
    {
      description              = "Lambda-to-RDSProxy-5432"
      from_port                = 5432
      to_port                  = 5432
      protocol                 = "tcp"
      source_security_group_id = module.lambda-private-sg.security_group_id
    },
  ]

  egress_rules = ["all-all"]

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-rds-proxy-sg"
  })
}

module "db-private-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 5.1.2"

  vpc_id      = module.vpc.vpc_id
  name        = "${var.client_name}-${var.stage}-postgres-private-sg"
  description = "${var.client_name}-${var.stage}-postgres-private-sg"

  ingress_with_source_security_group_id = [
    {
      description              = "RDSProxy-to-RDS-5432"
      from_port                = 5432
      to_port                  = 5432
      protocol                 = "tcp"
      source_security_group_id = module.rds-proxy-sg.security_group_id
    },
    {
      description              = "EC2-to-RDS-5432"
      from_port                = 5432
      to_port                  = 5432
      protocol                 = "tcp"
      source_security_group_id = module.ec2-private-sg.security_group_id
    },
  ]

  egress_rules = ["all-all"]

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-postgres-private-sg"
  })
}

module "lambda-private-sg" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 5.1.2"

  vpc_id      = module.vpc.vpc_id
  name        = "${var.client_name}-${var.stage}-lambda-private-sg"
  description = "${var.client_name}-${var.stage}-lambda-private-sg"

  egress_rules = ["all-all"]

  tags = merge(local.tags, {
    Name = "${var.client_name}-${var.stage}-lambda-private-sg"
  })
}