terraform {
  required_version = ">= 1.6"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
  }
  backend "azurerm" {}   # Werte aus backend.hcl
}

provider "azurerm" {
  features {}
}

variable "location" {
  type    = string
  default = "germanywestcentral"
}

variable "prefix" {
  type    = string
  default = "iaclab"
}

locals {
  tags = {
    managed_by = "terraform"
    project    = "iac-lab"
    layer      = "base"
  }
}

resource "azurerm_resource_group" "base" {
  name     = "rg-${var.prefix}-base"
  location = var.location
  tags     = local.tags
}

# --- Netz -------------------------------------------------------------

resource "azurerm_virtual_network" "vnet" {
  name                = "vnet-${var.prefix}"
  address_space       = ["10.42.0.0/16"]
  location            = azurerm_resource_group.base.location
  resource_group_name = azurerm_resource_group.base.name
  tags                = local.tags
}

resource "azurerm_subnet" "app" {
  name                            = "snet-app"
  resource_group_name             = azurerm_resource_group.base.name
  virtual_network_name            = azurerm_virtual_network.vnet.name
  address_prefixes                = ["10.42.1.0/24"]
  default_outbound_access_enabled = false   # Outbound nur explizit
}

resource "azurerm_network_security_group" "app" {
  name                = "nsg-${var.prefix}-app"
  location            = azurerm_resource_group.base.location
  resource_group_name = azurerm_resource_group.base.name
  tags                = local.tags

  security_rule {
    name                       = "allow-http-inbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }
  # Bewusst KEINE SSH-Regel: Nutzvieh wird nicht gestreichelt.
  # Health Probes des Load Balancers erlaubt die Default-Regel
  # AllowAzureLoadBalancerInBound.
}

resource "azurerm_subnet_network_security_group_association" "app" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app.id
}

# --- Compute Gallery für Golden Images --------------------------------

resource "azurerm_shared_image_gallery" "gallery" {
  name                = "gal_${var.prefix}"
  location            = azurerm_resource_group.base.location
  resource_group_name = azurerm_resource_group.base.name
  description         = "Golden Images für das IaC-Lab"
  tags                = local.tags
}

resource "azurerm_shared_image" "web" {
  name                = "img-web-ubuntu2404"
  gallery_name        = azurerm_shared_image_gallery.gallery.name
  resource_group_name = azurerm_resource_group.base.name
  location            = azurerm_resource_group.base.location
  os_type             = "Linux"
  hyper_v_generation  = "V2"

  identifier {
    publisher = "creutz"
    offer     = "iaclab"
    sku       = "web-ubuntu2404"
  }
  tags = local.tags
}

output "subnet_id" {
  value = azurerm_subnet.app.id
}

output "image_definition_id" {
  value = azurerm_shared_image.web.id
}