# DB subnet group ============================================================

resource "aws_db_subnet_group" "this" {
  for_each = local.create_subnet_group ? { sg = true } : {}

  name       = local.subnet_group_name
  subnet_ids = var.subnet_ids

  tags = local.tags
}

# DB parameter group =========================================================

resource "aws_db_parameter_group" "this" {
  name   = "${var.identifier}-params"
  family = var.parameter_group_family

  dynamic "parameter" {
    for_each = var.parameters
    content {
      name  = parameter.key
      value = parameter.value
    }
  }

  lifecycle {
    create_before_destroy = true
  }

  tags = local.tags
}

# RDS instance ===============================================================

resource "aws_db_instance" "this" {
  identifier     = var.identifier
  engine         = "postgres"
  engine_version = var.engine_version
  instance_class = var.instance_class

  allocated_storage     = var.allocated_storage
  max_allocated_storage = var.max_allocated_storage
  storage_type          = "gp3"
  storage_encrypted     = true
  kms_key_id            = var.kms_key_id

  db_name                     = var.db_name
  username                    = var.username
  password                    = var.manage_master_user_password ? null : var.password
  manage_master_user_password = var.manage_master_user_password

  db_subnet_group_name   = local.subnet_group_name
  vpc_security_group_ids = var.security_group_ids
  parameter_group_name   = aws_db_parameter_group.this.name
  multi_az               = var.multi_az

  backup_retention_period   = var.backup_retention_period
  backup_window             = var.backup_window
  maintenance_window        = var.maintenance_window
  deletion_protection       = var.deletion_protection
  skip_final_snapshot       = var.skip_final_snapshot
  final_snapshot_identifier = var.skip_final_snapshot ? null : "${var.identifier}-final"

  monitoring_interval                   = var.monitoring_interval
  monitoring_role_arn                   = local.monitoring_role_arn
  performance_insights_enabled          = var.performance_insights_enabled
  performance_insights_kms_key_id       = var.performance_insights_kms_key_id
  performance_insights_retention_period = var.performance_insights_enabled ? 7 : null

  copy_tags_to_snapshot      = true
  auto_minor_version_upgrade = false

  tags = local.tags

  depends_on = [aws_db_subnet_group.this]
}

# Read replicas ==============================================================

resource "aws_db_instance" "replica" {
  for_each = var.read_replicas

  identifier                 = "${var.identifier}-${each.key}"
  replicate_source_db        = aws_db_instance.this.identifier
  instance_class             = each.value
  storage_encrypted          = true
  kms_key_id                 = var.kms_key_id
  vpc_security_group_ids     = var.security_group_ids
  auto_minor_version_upgrade = false
  skip_final_snapshot        = true
  deletion_protection        = var.deletion_protection

  performance_insights_enabled = var.performance_insights_enabled

  tags = merge(local.tags, { Role = "replica" })
}