# Hosted zone lookups ========================================================

data "aws_route53_zone" "this" {
  for_each = local.dns_validated

  name         = each.value.zone_name
  private_zone = false
}

# Certificates ===============================================================

resource "aws_acm_certificate" "this" {
  for_each = var.certificates

  domain_name               = each.value.domain_name
  validation_method         = each.value.validation_method
  subject_alternative_names = each.value.subject_alternative_names
  key_algorithm             = each.value.key_algorithm

  lifecycle {
    create_before_destroy = true
  }

  tags = local.tags
}

# DNS validation records -----------------------------------------------------

resource "aws_route53_record" "validation" {
  for_each = {
    for item in flatten([
      for cert_key, cert in local.dns_validated : [
        for dvo in aws_acm_certificate.this[cert_key].domain_validation_options : {
          cert_key = cert_key
          domain   = dvo.domain_name
          name     = dvo.resource_record_name
          type     = dvo.resource_record_type
          record   = dvo.resource_record_value
          zone_id  = data.aws_route53_zone.this[cert_key].zone_id
        }
      ]
    ]) : "${item.cert_key}:${item.domain}" => item
  }

  zone_id = each.value.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.record]
  ttl     = 60

  allow_overwrite = true
}

# Validation waiter ----------------------------------------------------------

resource "aws_acm_certificate_validation" "this" {
  for_each = var.wait_for_validation ? local.dns_validated : {}

  certificate_arn         = aws_acm_certificate.this[each.key].arn
  validation_record_fqdns = [for record in aws_route53_record.validation : record.fqdn if startswith(record.id, "${each.key}:")]
}