main.tf

terraform {
  required_version = "~> 1.7"

  required_providers {
    # for the infra that will host Psoxy instances
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }

  # NOTE: Terraform backend block is configured in a separate 'backend.tf' file, as expect everyone
  # to customize it for their own use; whereas `main.tf` should be largely consistent across
  # deployments
}


## Data Sources configuration
## (eg, sources you want to connect to Worklytics)

# general cases
module "worklytics_connectors" {
  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors?ref=v0.7.0"

  enabled_connectors                       = var.enabled_connectors
  connector_settings                       = var.connector_settings
  base_dir                                 = var.psoxy_base_dir
  chat_gpt_enterprise_example_workspace_id = var.chat_gpt_enterprise_example_workspace_id
  confluence_example_cloud_id              = var.confluence_example_cloud_id
  confluence_example_group_id              = var.confluence_example_group_id
  jira_cloud_id                            = var.jira_cloud_id
  jira_server_url                          = var.jira_server_url
  jira_example_issue_id                    = var.jira_example_issue_id
  atlassian_organization_id                = var.atlassian_organization_id
  salesforce_domain                        = var.salesforce_domain
  github_api_host                          = var.github_api_host
  github_enterprise_server_host            = var.github_enterprise_server_host
  github_enterprise_server_version         = var.github_enterprise_server_version
  github_installation_id                   = var.github_installation_id
  github_copilot_installation_id           = var.github_copilot_installation_id
  github_organization                      = var.github_organization
  github_example_repository                = var.github_example_repository
  gitlab_url                               = var.gitlab_url
  gitlab_example_group_id                  = var.gitlab_example_group_id
  gitlab_example_project_id                = var.gitlab_example_project_id
  gong_instance_subdomain                  = var.gong_instance_subdomain
  glean_instance_subdomain                 = var.glean_instance_subdomain
  salesforce_example_account_id            = var.salesforce_example_account_id
  todos_as_local_files                     = var.todos_as_local_files
  todo_step                                = 1
}

# sources which require additional dependencies are split into distinct Terraform files, following
# the naming convention of `{source-identifier}.tf`, eg `msft-365.tf`
# lines below merge results of those files back into single maps of sources
locals {
  api_connectors = merge(
    module.worklytics_connectors.enabled_api_connectors,
    module.worklytics_connectors_google_workspace.enabled_api_connectors,
    local.msft_api_connectors_with_auth,
    var.custom_api_connectors,
    {}
  )

  custom_bulk_connectors_with_defaults = {
    for k, v in var.custom_bulk_connectors : k => merge({
      display_name              = coalesce(try(v.display_name, null), replace(k, "-", " "))
      worklytics_connector_id   = coalesce(try(v.worklytics_connector_id, null), "bulk-import-psoxy")
      worklytics_connector_name = coalesce(try(v.worklytics_connector_name, null), "${coalesce(try(v.display_name, null), replace(k, "-", " "))} via Psoxy")
    }, v)
  }

  bulk_connectors = merge(
    module.worklytics_connectors.enabled_bulk_connectors,
    local.custom_bulk_connectors_with_defaults,
  )

  source_authorization_todos = concat(
    module.worklytics_connectors.todos,
    module.worklytics_connectors_google_workspace.todos,
    module.worklytics_connectors_msft_365.todos,
    module.psoxy.setup_todos,
    []
  )

  max_auth_todo_step = max(
    module.worklytics_connectors.next_todo_step,
    module.worklytics_connectors_google_workspace.next_todo_step,
    module.worklytics_connectors_msft_365.next_todo_step,
    0
  )
}


## Host platform (AWS) configuration

# NOTE: you need to provide credentials. usual way to do this is to set env vars:
#        AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
# see https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication for more
# information as well as alternative auth approaches
provider "aws" {
  region = var.aws_region

  assume_role {
    role_arn = var.aws_assume_role_arn
  }

  default_tags {
    tags = var.default_tags
  }

  allowed_account_ids = [
    var.aws_account_id
  ]
}

locals {
  host_platform_id = "AWS"
}

module "psoxy" {
  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-host?ref=v0.7.0"

  environment_name                     = var.environment_name
  aws_account_id                       = var.aws_account_id
  aws_ssm_param_root_path              = var.aws_ssm_param_root_path
  psoxy_base_dir                       = var.psoxy_base_dir
  deployment_bundle                    = var.deployment_bundle
  install_test_tool                    = var.install_test_tool
  provision_testing_infra              = var.provision_testing_infra
  force_bundle                         = var.force_bundle
  caller_gcp_service_account_ids       = var.caller_gcp_service_account_ids
  caller_aws_arns                      = var.caller_aws_arns
  test_aws_principal_arns              = var.test_aws_principal_arns
  non_production_connectors            = var.non_production_connectors
  custom_api_connector_rules           = var.custom_api_connector_rules
  lookup_table_builders                = var.lookup_table_builders
  pseudonymize_app_ids                 = var.pseudonymize_app_ids
  email_canonicalization               = var.email_canonicalization
  general_environment_variables        = var.general_environment_variables
  new_relic_account_id                 = var.new_relic_account_id
  function_env_kms_key_arn             = var.project_aws_kms_key_arn
  logs_kms_key_arn                     = var.project_aws_kms_key_arn
  log_retention_days                   = var.log_retention_days
  aws_ssm_key_id                       = var.project_aws_kms_key_arn
  use_api_gateway_v2                   = var.use_api_gateway_v2
  aws_lambda_execution_role_policy_arn = var.aws_lambda_execution_role_policy_arn
  iam_roles_permissions_boundary       = var.iam_roles_permissions_boundary
  secrets_store_implementation         = var.secrets_store_implementation
  bulk_sanitized_expiration_days       = var.bulk_sanitized_expiration_days
  bulk_input_expiration_days           = var.bulk_input_expiration_days
  allowed_data_access_ip_blocks        = var.allowed_data_access_ip_blocks
  allowed_webhook_ip_blocks            = var.allowed_webhook_ip_blocks
  api_connectors                       = local.api_connectors
  bulk_connectors                      = local.bulk_connectors
  webhook_collectors = { for k, v in var.webhook_collectors : k => merge(
    v,
    {
      example_payload = try(file(v.example_payload_file), null)
    }
  ) }
  provision_bucket_public_access_block = var.provision_bucket_public_access_block
  custom_bulk_connector_rules          = var.custom_bulk_connector_rules
  custom_bulk_connector_arguments      = var.custom_bulk_connector_arguments
  custom_side_outputs                  = var.custom_side_outputs
  todo_step                            = local.max_auth_todo_step
  todos_as_local_files                 = var.todos_as_local_files
  enable_remote_resources              = true


  #  vpc_config = {
  #    vpc_id             = aws_default_vpc.default.id
  #    security_group_ids = [aws_security_group.default.id]
  #    subnet_ids         = [aws_default_subnet.default.id]
  #  }
}

## Worklytics connection configuration
#  as of June 2023, this just outputs TODO files, but would provision connections via future
#  Worklytics API / Terraform provider

locals {
  # Webhook collectors are handled separately to avoid cycles - their metadata comes from outputs
  webhook_connectors_for_worklytics = {
    for k, v in module.psoxy.webhook_collector_instances : k => {
      source_kind           = var.webhook_collectors[k].source_kind
      sanitized_bucket_name = v.output_sanitized_bucket_id
      display_name          = var.webhook_collectors[k].display_name
      settings_to_provide   = {}
    }
  }

  all_connectors = merge(local.api_connectors, local.bulk_connectors, local.webhook_connectors_for_worklytics)
  all_instances  = merge(module.psoxy.bulk_connector_instances, module.psoxy.api_connector_instances, module.psoxy.webhook_collector_instances)
}

module "connection_in_worklytics" {
  for_each = local.all_instances

  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-proxy-connection-aws?ref=v0.7.0"

  proxy_instance_id    = each.key
  worklytics_host      = var.worklytics_host
  aws_region           = var.aws_region
  aws_role_arn         = module.psoxy.caller_role_arn
  proxy_endpoint_url   = try(each.value.endpoint_url, null)
  bucket_name          = try(each.value.sanitized_bucket, null)
  connector_id         = try(local.all_connectors[each.key].worklytics_connector_id, "bulk-import-psoxy", "")
  display_name         = try(local.all_connectors[each.key].worklytics_connector_name, "${try(local.all_connectors[each.key].display_name, replace(each.key, "-", " "))} via Psoxy", "${replace(each.key, "-", " ")} via Psoxy")
  todo_step            = module.psoxy.next_todo_step
  todos_as_local_files = var.todos_as_local_files

  connector_settings_to_provide = merge(
    try(each.value.settings_to_provide, {}),
    try(local.all_connectors[each.key].settings_to_provide, {}),
  )
}

output "path_to_deployment_jar" {
  description = "Path to the package to deploy (JAR)."
  value       = module.psoxy.path_to_deployment_jar
}

output "api_connector_instances" {
  value = { for k, v in module.psoxy.api_connector_instances : k => {
    endpoint_url     = v.endpoint_url
    sanitized_bucket = v.sanitized_bucket
    test_examples    = v.test_examples
  } }
}

output "bulk_connector_instances" {
  value = { for k, v in module.psoxy.bulk_connector_instances : k => {
    input_bucket     = try(v.input_bucket, null)
    sanitized_bucket = v.sanitized_bucket
    example_files    = try(v.example_files, [])
  } }
}

output "webhook_collector_instances" {
  value = { for k, v in module.psoxy.webhook_collector_instances : k => {
    endpoint_url     = try(v.endpoint_url, null)
    sanitized_bucket = v.output_sanitized_bucket_id
    test_examples    = try(v.test_examples, [])
  } }
}

output "caller_role_arn" {
  description = "ARN of the AWS role to impersonate when making API calls (AWS case)"
  value       = module.psoxy.caller_role_arn
}

output "todos_1" {
  description = "List of todo steps to complete 1st, in markdown format."
  value       = var.todos_as_outputs ? join("\n", local.source_authorization_todos) : null
}

output "todos_2" {
  description = "List of todo steps to complete 2nd, in markdown format."
  value       = var.todos_as_outputs ? join("\n", module.psoxy.todos) : null
}

output "todos_3" {
  description = "List of todo steps to complete 3rd, in markdown format."
  value       = var.todos_as_outputs ? join("\n", values(module.connection_in_worklytics)[*].todo) : null
}

# although should be sensitive such that Terraform won't echo it to command line or expose it, leave
# commented out in example until needed
# if you uncomment it, you will then be able to obtain the value through `terraform output --raw pseudonym_salt`
#output "pseudonym_salt" {
#  description = "Value used to salt pseudonyms (SHA-256) hashes. If migrate to new deployment, you should copy this value."
#  value       = module.psoxy.pseudonym_salt
#  sensitive   = true
#}