# ---------------------------------------------------------------------------
# Playground database: one RDS PostgreSQL instance with pgvector.
#
# The instance carries a public address so the developer host can restore the
# schema and run the local playground against it; the security group is what
# keeps it closed. It admits exactly two sources: the playground task's
# security group, and the operator's address from terraform.tfvars.
#
# The master password follows the same rule as every other secret in this
# stack: the value in Terraform is a throwaway used only at creation, rotated
# out of band right after the first apply and ignored for drift thereafter,
# so the real password lives in Parameter Store and never in state:
#
#   aws rds modify-db-instance --db-instance-identifier quber-playground \
#     --master-user-password "$(aws ssm get-parameter --name /quber/POSTGRES_PASSWORD \
#       --with-decryption --query Parameter.Value --output text)" --apply-immediately
# ---------------------------------------------------------------------------

locals {
  playground_tags = {
    Component = "playground"
    Jira      = "QUE-329"
  }
}

resource "aws_db_subnet_group" "playground" {
  name       = "quber-playground"
  subnet_ids = data.aws_subnets.default.ids
  tags       = local.playground_tags
}

# The playground service's own security group. Declared here so the database
# can admit it by reference; the Fargate service attaches it.
resource "aws_security_group" "playground_task" {
  name        = "quber-playground-task"
  description = "Playground Fargate task: egress only, ingress from its load balancer"
  vpc_id      = data.aws_vpc.default.id
  tags        = local.playground_tags

  egress {
    description = "All egress (ECR, S3, RDS, Anthropic, RunPod, ADE)"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "playground_db" {
  name        = "quber-playground-db"
  description = "Playground RDS: Postgres from the playground task and the operator host only"
  vpc_id      = data.aws_vpc.default.id
  tags        = local.playground_tags

  ingress {
    description     = "Postgres from the playground task"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.playground_task.id]
  }

  ingress {
    description = "Postgres from the operator host (schema restore, local playground against RDS)"
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = [var.operator_cidr]
  }
}

resource "aws_db_instance" "playground" {
  identifier     = "quber-playground"
  engine         = "postgres"
  engine_version = var.db_engine_version
  instance_class = var.db_instance_class

  allocated_storage = var.db_allocated_storage
  storage_type      = "gp3"
  storage_encrypted = true

  db_name  = var.db_name
  username = var.db_username
  password = var.db_initial_password

  db_subnet_group_name   = aws_db_subnet_group.playground.name
  vpc_security_group_ids = [aws_security_group.playground_db.id]
  publicly_accessible    = true
  multi_az               = false

  backup_retention_period    = 7
  auto_minor_version_upgrade = true
  deletion_protection        = true
  skip_final_snapshot        = false
  final_snapshot_identifier  = "quber-playground-final"
  apply_immediately          = true

  tags = local.playground_tags

  lifecycle {
    ignore_changes = [password]
  }
}