require "chef/provisioning/aws_driver"

with_driver "aws::us-west-1"

#
# This recipe sets every single value of every single object
#

# aws_vpc 'ref-vpc' do
#   action :purge
# end

aws_dhcp_options "ref-dhcp-options" do
  domain_name          "example.com"
  domain_name_servers  %w{8.8.8.8 8.8.4.4}
  ntp_servers          %w{8.8.8.8 8.8.4.4}
  netbios_name_servers %w{8.8.8.8 8.8.4.4}
  netbios_node_type    2
  aws_tags chef_type: "aws_dhcp_options"
end

aws_vpc "ref-vpc" do
  cidr_block "10.0.0.0/24"
  internet_gateway true
  instance_tenancy :default
  main_routes "0.0.0.0/0" => :internet_gateway
  dhcp_options "ref-dhcp-options"
  enable_dns_support true
  enable_dns_hostnames true
  aws_tags chef_type: "aws_vpc"
end

aws_route_table "ref-main-route-table" do
  vpc "ref-vpc"
  routes "0.0.0.0/0" => :internet_gateway
  aws_tags chef_type: "aws_route_table"
end

aws_vpc "ref-vpc" do
  main_route_table "ref-main-route-table"
end

aws_key_pair "ref-key-pair" do
  private_key_options(
    format: :pem,
    type: :rsa,
    regenerate_if_different: true
  )
  allow_overwrite true
end

aws_security_group "ref-sg1" do
  vpc "ref-vpc"
  inbound_rules "0.0.0.0/0" => [22, 80]
  outbound_rules [
    { port: 22..22, protocol: :tcp, destinations: ["0.0.0.0/0"] }
  ]
  aws_tags chef_type: "aws_security_group"
end

aws_route_table "ref-public" do
  vpc "ref-vpc"
  routes "0.0.0.0/0" => :internet_gateway
  aws_tags chef_type: "aws_route_table"
end

aws_network_acl "ref-acl" do
  vpc "ref-vpc"
  inbound_rules(
    [
      { rule_number: 100, action: :allow, protocol: -1, cidr_block: "0.0.0.0/0" },
      { rule_number: 200, action: :allow, protocol: 6, port_range: 443..443, cidr_block: "172.31.0.0/24" }
    ]
  )
  outbound_rules(
    [
      { rule_number: 100, action: :allow, protocol: -1, cidr_block: "0.0.0.0/0" }
    ]
  )
end

aws_subnet "ref-subnet" do
  vpc "ref-vpc"
  cidr_block "10.0.0.0/26"
  availability_zone "us-west-1a"
  map_public_ip_on_launch true
  route_table "ref-public"
  aws_tags chef_type: "aws_subnet"
  network_acl "ref-acl"
end

ref_subnet_2 = aws_subnet "ref-subnet-2" do
  vpc "ref-vpc"
  cidr_block "10.0.0.64/26"
  availability_zone "us-west-1b"
  map_public_ip_on_launch true
  route_table "ref-public"
  aws_tags chef_type: "aws_subnet"
  network_acl "ref-acl"
end

# We cover tagging the base chef-provisioning resources in aws_tags.rb
machine_image "ref-machine_image1" do
  image_options description: "some image description"
end

machine_image "ref-machine_image2" do
  from_image "ref-machine_image1"
end

machine_image "ref-machine_image3" do
  machine_options bootstrap_options: {
    # for some reason, sshing into this host takes 20+ seconds with these enabled
    # subnet_id: 'ref-subnet',
    # security_group_ids: 'ref-sg1',
    image_id: "ref-machine_image1",
    instance_type: "t2.small"
  }
end

machine_batch do
  machine "ref-machine1" do
    machine_options bootstrap_options: { image_id: "ref-machine_image1", availability_zone: "us-west-1a", instance_type: "m3.medium" }
    ohai_hints "ec2" => { "a" => "b" }
    converge false
  end
  machine "ref-machine2" do
    from_image "ref-machine_image1"
    machine_options bootstrap_options: {
      key_name: "ref-key-pair",
      # subnet_id: 'ref-subnet',
      # security_group_ids: 'ref-sg1'
    }
  end
end

load_balancer "ref-load-balancer" do
  machines ["ref-machine2"]
  load_balancer_options(
    attributes: {
      cross_zone_load_balancing: {
        enabled: true
      }
    }
  )
end

aws_launch_configuration "ref-launch-configuration" do
  image "ref-machine_image1"
  instance_type "t1.micro"
  options security_groups: "ref-sg1"
end

aws_auto_scaling_group "ref-auto-scaling-group" do
  availability_zones ["us-west-1a"]
  desired_capacity 2
  min_size 1
  max_size 3
  launch_configuration "ref-launch-configuration"
  load_balancers "ref-load-balancer"
  options subnets: "ref-subnet"
end

aws_ebs_volume "ref-volume" do
  machine "ref-machine1"
  availability_zone "a"
  size 100
  # snapshot
  iops 3000
  volume_type "io1"
  encrypted true
  device "/dev/sda2"
  aws_tags chef_type: "aws_ebs_volume"
end

aws_eip_address "ref-elastic-ip" do
  machine "ref-machine1"
  associate_to_vpc true
  # guh - every other AWSResourceWithEntry accepts tags EXCEPT this one
end

aws_s3_bucket "ref-s3-bucket" do
  enable_website_hosting true
  options(acl: "private")
end

# Options can be given from attribute parameter value.
# Link :docs.aws.amazon.com/sdkforruby/api/Aws/SQS/Client.html#attributes
aws_sqs_queue "ref-sqs-queue" do
  options(DelaySeconds: "1", ReceiveMessageWaitTimeSeconds: "1")
end

aws_sns_topic "ref-sns-topic" do
end

aws_server_certificate "ref-server-certificate" do
  certificate_body "-----BEGIN CERTIFICATE-----\nMIIE+TCCA+GgAwIBAgIQU306HIX4KsioTW1s2A2krTANBgkqhkiG9w0BAQUFADCB\ntTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL\nExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug\nYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSoAYykwOTEvMC0GA1UEAxMm\nVmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzIwHhcNMTAxMDA4\nMDAwMDAwWhcNMTMxMDA3MjM1OTU5WjBqMQswCQYDVQQGEwJVUzETMBEGA1UECBMK\nV2FzaGluZ3RvbjEQMA4GA1UEBxQHU2VhdHRsZTEYMBYGA1UEChQPQW1hem9uLmNv\nbSBJbmMuMRowGAYDVQQDFBFpYW0uYW1hem9uYXdzLmNvbTCBnzANBgkqhkiG9w0B\nAQEFAAOBjQAwgYkCgYEA3Xb0EGea2dB8QGEUwLcEpwvGawEkUdLZmGL1rQJZdeeN\n3vaF+ZTm8Qw5Adk2Gr/RwYXtpx04xvQXmNm+9YmksHmCZdruCrW1eN/P9wBfqMMZ\nX964CjVov3NrF5AuxU8jgtw0yu//C3hWnOuIVGdg76626ggOoJSaj48R2n0MnVcC\nAwEAAaOCAdEwggHNMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMEUGA1UdHwQ+MDww\nOqA4oDaGNGh0dHA6Ly9TVlJTZWN1cmUtRzItY3JsLnZlcmlzaWduLmNvbS9TVlJT\nZWN1cmVHMi5jcmwwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcXAzAqMCgGCCsGAQUF\nBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMB0GA1UdJQQWMBQGCCsG\nAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBSl7wsRzsBBA6NKZZBIshzgVy19\nRzB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlz\naWduLmNvbTBABggrBgEFBQcwAoY0aHR0cDovL1NWUlNlY3VyZS1HMi1haWEudmVy\naXNpZ24uY29tL1NWUlNlY3VyZUcyLmNlcjBuBggrBgEFBQcBDARiMGChXqBcMFow\nWDBWFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBRLa7kolgYMu9BSOJsprEsHiyEF\nGDAmFiRodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvMS5naWYwDQYJKoZI\nhvcNAQEFBQADggEBALpFBXeG782QsTtGwEE9zBcVCuKjrsl3dWK1dFiq3OP4y/Bi\nZBYEywBt8zNuYFUE25Ub/zmvmpe7p0G76tmQ8bRp/4qkJoiSesHJvFgJ1mksr3IQ\n3gaE1aN2BSUIHxGLn9N4F09hYwwbeEZaCxfgBiLdEIodNwzcvGJ+2LlDWGJOGrNI\nNM856xjqhJCPxYzk9buuCl1B4Kzu0CTbexz/iEgYV+DiuTxcfA4uhwMDSe0nynbn\n1qiwRk450mCOnqH4ly4P4lXo02t4A/DI1I8ZNct/Qfl69a2Lf6vc9rF7BELT0e5Y\n123RVWYBAZW00EXAMPLE456RVWYBAZW00EXAMPLE\n-----END CERTIFICATE-----\n"
  private_key "-----BEGIN RSA PRIVATE KEY-----\nMIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC\nVVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6\nb24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd\nBgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN\nMTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD\nVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z\nb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt\nYXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ\n21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T\nrDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE\nIbb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4\nnUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb\nFFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb\nNYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=\n-----END RSA PRIVATE KEY-----\n"
end

aws_rds_subnet_group "ref-db-subnet-group" do
  description "some_description"
  subnets ["ref-subnet", lazy { ref_subnet_2.aws_object.id }]
end

aws_rds_instance "ref-rds-instance" do
  engine "postgres"
  publicly_accessible false
  db_instance_class "db.t1.micro"
  master_username "thechief"
  master_user_password "securesecure" # 2x security
  multi_az false
  db_subnet_group_name "ref-db-subnet-group"
  allocated_storage 5
end

aws_cloudsearch_domain "ref-cs-domain" do
  multi_az false
  instance_type "search.m1.small"
  partition_count 2
  replication_count 2
  index_fields [{ index_field_name: "foo",
                  index_field_type: "text" }]
end

aws_elasticsearch_domain "ref-es-domain" do
  instance_type "m3.medium.elasticsearch"
  ebs_enabled true
  volume_size 10
  automated_snapshot_start_hour 2
end

ec2_principal = <<-EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF

iam_role_policy = <<-EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*"
    }
  ]
}
EOF
aws_iam_role "ref_iam_role" do
  path "/"
  assume_role_policy_document ec2_principal
  inline_policies iam_role_policy: iam_role_policy
end

aws_iam_instance_profile "ref_iam_instance_role" do
  path "/"
  role "ref_iam_role"
end
