# Setup the SSH key in the Hetzner Cloud Console
resource "hcloud_ssh_key" "ansible" {
  name       = var.project_name
  public_key = var.ssh_public_key
}

# Provision the Hetzner Cloud VPS
resource "hcloud_server" "dokploy" {
  name         = var.project_name
  image        = var.hcloud_image
  server_type  = var.hcloud_server_type
  location     = var.hcloud_location
  ssh_keys     = [hcloud_ssh_key.ansible.id]
  firewall_ids = [hcloud_firewall.host.id]

  public_net {
    ipv4_enabled = true
  }
}

# Configure Hetzner Cloud Firewall
resource "hcloud_firewall" "host" {
  name = var.project_name

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "80"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "443"
    source_ips = ["0.0.0.0/0", "::/0"]
  }

  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "22"
    source_ips = ["0.0.0.0/0", "::/0"]
  }
}

# Resolve the Cloudflare zone from its apex domain name
data "cloudflare_zone" "zone" {
  filter = {
    name = var.domain_name
  }
}

locals {
  public_ip = hcloud_server.dokploy.ipv4_address
}

# Publish the VPS IP as a Cloudflare A record
resource "cloudflare_dns_record" "domain" {
  zone_id = data.cloudflare_zone.zone.id
  name    = "@"
  type    = "A"
  content = local.public_ip
  proxied = var.cloudflare_proxied
  ttl     = var.cloudflare_proxied ? 1 : 3600
}

resource "cloudflare_dns_record" "subdomain" {
  zone_id = data.cloudflare_zone.zone.id
  name    = "*"
  type    = "A"
  content = local.public_ip
  proxied = var.cloudflare_proxied
  ttl     = var.cloudflare_proxied ? 1 : 3600
}

# Write IP to Ansible inventory
resource "local_file" "ansible_inventory" {
  content = templatefile("${path.module}/../ansible/inventory.tpl", {
    public_ip = local.public_ip
  })
  filename = "${path.module}/../ansible/inventory.ini"
}

output "public_ip" {
  description = "The public IPv4 address of the provisioned Hetzner Cloud VPS"
  value       = local.public_ip
}