resource "aws_security_group" "lb_backend" {
	name        = var.lb_backend_security_group_name
	description = "Allow Backend Load Balancer inbound traffic"
	vpc_id      = var.aws_vpc_id

	ingress {
		from_port   = 443
		to_port     = 444
		protocol    = "tcp"
		cidr_blocks = ["0.0.0.0/0"]
	}

	egress {
		from_port   = 0
		to_port     = 0
		protocol    = "-1"
		cidr_blocks = ["0.0.0.0/0"]
	}
}

resource "aws_lb" "backend" {
	name               = var.lb_backend_name
	internal           = false
	load_balancer_type = "application"
	ip_address_type    = "ipv4"
	security_groups    = [aws_security_group.lb_backend.id]
	subnets            = [var.aws_subnets.a, var.aws_subnets.b]
}

resource "aws_lb_listener" "backend" {
	load_balancer_arn = aws_lb.backend.arn
	port              = 443
	protocol          = "HTTPS"
	ssl_policy        = "ELBSecurityPolicy-2016-08"
	certificate_arn   = "arn:aws:acm:eu-central-1:903393797582:certificate/5b835188-78e7-4923-baea-1da327b794a7"

	default_action {
		type = "fixed-response"

		fixed_response {
			content_type = "text/plain"
			message_body = "Not found"
			status_code  = "404"
		}
	}
}