data "aws_rds_certificate" "latest" {
  latest_valid_till = true
}

resource "aws_security_group" "main_db" {
  name   = "main-db-${var.stage}"
  vpc_id = var.aws_vpc_id

  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    stage = var.stage
  }
}

resource "aws_db_subnet_group" "main_db" {
  name       = "main-db-${var.stage}"
  subnet_ids = [var.aws_subnets.a, var.aws_subnets.b]

  tags = {
    stage = var.stage
  }
}

resource "aws_db_instance" "main_db" {
  identifier = "main-db-${var.stage}"

  engine         = "postgres"
  engine_version = "18.3"
  instance_class = var.instance_class

  username = var.postgres_username
  password = var.postgres_password
  port     = 5432
  db_name  = var.postgres_database

  parameter_group_name   = var.parameter_group_name
  db_subnet_group_name   = aws_db_subnet_group.main_db.name
  vpc_security_group_ids = [aws_security_group.main_db.id]

  multi_az          = false
  availability_zone = format("%s%s", var.aws_region, "a")

  deletion_protection = true

  allocated_storage     = 20
  max_allocated_storage = 0

  network_type        = "IPV4"
  publicly_accessible = true

  ca_cert_identifier = data.aws_rds_certificate.latest.id

  performance_insights_enabled          = var.performance_insights_enabled
  performance_insights_retention_period = var.performance_insights_retention_period

  auto_minor_version_upgrade  = false
  allow_major_version_upgrade = false

  backup_retention_period = var.backup_retention_period

  enabled_cloudwatch_logs_exports = var.stage == "production" ? ["postgresql", "upgrade"] : ["upgrade"]

  snapshot_identifier = var.snapshot

	lifecycle {
		# prevent_destroy = true
		ignore_changes = [ca_cert_identifier]
	}

	tags = {
		stage = var.stage
	}
}