# FSx for Windows File Server =================================================

# Security Group ---------------------------------------------------------------

resource "aws_security_group" "fsx" {
  name        = "${var.name}-sg"
  description = "Controls SMB access to FSx for Windows File Server: ${var.name}."
  vpc_id      = var.vpc_id

  tags = merge(local.tags, { Name = "${var.name}-sg" })
}

resource "aws_vpc_security_group_ingress_rule" "smb_sg" {
  for_each = toset(var.allowed_security_group_ids)

  security_group_id            = aws_security_group.fsx.id
  description                  = "SMB from ${each.value}."
  from_port                    = 445
  to_port                      = 445
  ip_protocol                  = "tcp"
  referenced_security_group_id = each.value

  tags = local.tags
}

resource "aws_vpc_security_group_ingress_rule" "smb_cidr" {
  for_each = toset(var.allowed_cidr_blocks)

  security_group_id = aws_security_group.fsx.id
  description       = "SMB from ${each.value}."
  from_port         = 445
  to_port           = 445
  ip_protocol       = "tcp"
  cidr_ipv4         = each.value

  tags = local.tags
}

resource "aws_vpc_security_group_egress_rule" "all" {
  security_group_id = aws_security_group.fsx.id
  description       = "Allow all egress."
  ip_protocol       = "-1"
  cidr_ipv4         = "0.0.0.0/0"

  tags = local.tags
}

# Filesystem -------------------------------------------------------------------

resource "aws_fsx_windows_file_system" "this" {
  storage_capacity                  = var.storage_capacity_gb
  storage_type                      = var.storage_type
  throughput_capacity               = var.throughput_capacity_mbps
  subnet_ids                        = var.subnet_ids
  preferred_subnet_id               = local.preferred_subnet_id
  deployment_type                   = var.deployment_type
  security_group_ids                = [aws_security_group.fsx.id]
  kms_key_id                        = var.kms_key_id
  automatic_backup_retention_days   = var.automatic_backup_retention_days
  daily_automatic_backup_start_time = var.automatic_backup_retention_days > 0 ? var.daily_automatic_backup_start_time : null
  weekly_maintenance_start_time     = var.weekly_maintenance_start_time
  copy_tags_to_backups              = var.copy_tags_to_backups
  aliases                           = var.dns_aliases

  # FSx for Windows requires AD for authentication. Managed AD is not supported
  # in this module — use self-managed AD (on-prem or EC2-hosted).
  self_managed_active_directory {
    domain_name                            = var.active_directory.domain_name
    dns_ips                                = var.active_directory.dns_ips
    username                               = var.active_directory.username
    password                               = var.active_directory.password
    organizational_unit_distinguished_name = var.active_directory.organizational_unit_distinguished_name
    file_system_administrators_group       = var.active_directory.file_system_administrators_group
  }

  dynamic "audit_log_configuration" {
    for_each = local.audit_log_enabled ? [1] : []
    content {
      audit_log_destination             = var.audit_log_destination_arn
      file_access_audit_log_level       = var.file_access_audit_log_level
      file_share_access_audit_log_level = var.file_share_access_audit_log_level
    }
  }

  tags = merge(local.tags, { Name = var.name })

  lifecycle {
    # FSx filesystems contain live data — prevent accidental destroy.
    # Remove this lifecycle block only when decommissioning intentionally.
    prevent_destroy = true
  }
}