// TODO: state in GCS bucket

terraform {
  required_providers {
    ko  = { source = "ko-build/ko" }
    oci = { source = "chainguard-dev/oci" }
  }
}

locals {
  project_id = "jason-chainguard"
  region     = "us-central1"
}

provider "google" {
  project = local.project_id
  region  = local.region
}

provider "google-beta" {
  project = local.project_id
  region  = local.region
}

provider "ko" { repo = "gcr.io/${local.project_id}/litestream/app" }

resource "google_storage_bucket" "bucket" {
  name     = "${local.project_id}-litestream"
  location = local.region
}

resource "google_service_account" "sa" {
  account_id   = "litestream"
  display_name = "Litestream Service Account"
}

resource "google_storage_bucket_iam_binding" "binding" {
  bucket  = google_storage_bucket.bucket.name
  role    = "roles/storage.admin"
  members = ["serviceAccount:${google_service_account.sa.email}"]
}

resource "ko_build" "build" {
  importpath  = "./"
  working_dir = path.module
  base_image  = "cgr.dev/chainguard/glibc-dynamic"
  env = [
    "CGO_ENABLED=1",
    "CC=zig cc -target x86_64-linux-gnu",
    "CXX=zig c++ -target x86_64-linux-gnu",
    "GOFLAGS=-tags=vfs",
  ]
}

resource "google_cloud_run_v2_service" "service" {
  provider = google-beta // for empty_dir

  name         = "litestream"
  location     = local.region
  launch_stage = "BETA"
  ingress      = "INGRESS_TRAFFIC_ALL"

  template {
    scaling {
      // Litestream VFS write mode uses optimistic conflict detection,
      // not distributed locking. Only a single writer is supported.
      max_instance_count = 1
    }

    // Allow max concurrent requests to the single replica.
    max_instance_request_concurrency = 1000

    service_account = google_service_account.sa.email

    containers {
      image = ko_build.build.image_ref
      volume_mounts {
        name       = "data"
        mount_path = "/data"
      }
      env {
        name  = "LITESTREAM_REPLICA_URL"
        value = "gs://${google_storage_bucket.bucket.name}/litestream"
      }
      env {
        name  = "LITESTREAM_BUFFER_PATH"
        value = "/data/db.sqlite"
      }
    }

    volumes {
      name = "data"
      empty_dir {
        medium     = "MEMORY"
        size_limit = "256Mi"
      }
    }
  }
}

// Allow all users to invoke the service
resource "google_cloud_run_v2_service_iam_member" "public" {
  name   = google_cloud_run_v2_service.service.name
  role   = "roles/run.invoker"
  member = "allUsers"
}

output "url" { value = google_cloud_run_v2_service.service.uri }
output "app-image" { value = ko_build.build.image_ref }