# =============================================================================
# sanguo_vnpy 阿里云生产环境 Terraform 配置
# 版本: v1.0
# 作者: 姜维（后勤总督）
# =============================================================================

terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = ">= 1.212.0"
    }
  }
}

provider "alicloud" {
  access_key = var.alicloud_access_key
  secret_key = var.alicloud_secret_key
  region     = var.alicloud_region
}

# =============================================================================
# 变量定义
# =============================================================================

variable "alicloud_access_key" {
  description = "阿里云 Access Key"
  type        = string
  sensitive   = true
}

variable "alicloud_secret_key" {
  description = "阿里云 Secret Key"
  type        = string
  sensitive   = true
}

variable "alicloud_region" {
  description = "阿里云区域"
  type        = string
  default     = "cn-hangzhou"
}

variable "environment" {
  description = "环境类型: production/testing/development"
  type        = string
  default     = "production"
}

variable "instance_type" {
  description = "ECS 实例规格"
  type        = string
  default     = "ecs.c6.large"
}

variable "vpc_cidr" {
  description = "VPC CIDR 块"
  type        = string
  default     = "10.0.0.0/16"
}

variable "vswitch_cidr" {
  description = "虚拟交换机 CIDR 块"
  type        = string
  default     = "10.0.0.0/24"
}

# =============================================================================
# VPC 网络
# =============================================================================

resource "alicloud_vpc" "sanguo_vpc" {
  vpc_name   = "sanguo-vnpy-${var.environment}-vpc"
  cidr_block = var.vpc_cidr
}

resource "alicloud_vswitch" "sanguo_vswitch" {
  vswitch_name = "sanguo-vnpy-${var.environment}-vswitch"
  vpc_id       = alicloud_vpc.sanguo_vpc.id
  cidr_block   = var.vswitch_cidr
  zone_id      = "${var.alicloud_region}-a"
}

# =============================================================================
# 安全组
# =============================================================================

resource "alicloud_security_group" "sanguo_sg" {
  name        = "sanguo-vnpy-${var.environment}-sg"
  description = "sanguo_vnpy ${var.environment} 安全组"
  vpc_id      = alicloud_vpc.sanguo_vpc.id
}

resource "alicloud_security_group_rule" "allow_ssh" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "22/22"
  priority          = 1
  security_group_id = alicloud_security_group.sanguo_sg.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_security_group_rule" "allow_http" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "80/80"
  priority          = 2
  security_group_id = alicloud_security_group.sanguo_sg.id
  cidr_ip           = "0.0.0.0/0"
}

resource "alicloud_security_group_rule" "allow_vnpy" {
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "8080/8080"
  priority          = 3
  security_group_id = alicloud_security_group.sanguo_sg.id
  cidr_ip           = "0.0.0.0/0"
}

# =============================================================================
# ECS 实例
# =============================================================================

resource "alicloud_instance" "sanguo_ecs" {
  instance_name        = "sanguo-vnpy-${var.environment}-ecs"
  availability_zone    = "${var.alicloud_region}-a"
  instance_type        = var.instance_type
  security_groups      = [alicloud_security_group.sanguo_sg.id]
  vswitch_id           = alicloud_vswitch.sanguo_vswitch.id
  internet_charge_type = "PayByTraffic"
  internet_max_bandwidth_out = 100
  
  system_disk_size    = 40
  system_disk_category = "cloud_efficiency"
  
  image_id = "ubuntu_22_04_x64_20G_alibase_20240228.vhd"
  
  password = var.ecs_password
  instance_charge_type = "PostPaid"
}

variable "ecs_password" {
  description = "ECS 实例密码"
  type        = string
  sensitive   = true
  default     = "Sanguo@2024!"
}

# =============================================================================
# OSS 对象存储
# =============================================================================

resource "alicloud_oss_bucket" "sanguo_oss" {
  bucket = "sanguo-vnpy-${var.environment}-data"
  acl    = "private"
}

# =============================================================================
# RDS 数据库（可选）
# =============================================================================

resource "alicloud_db_instance" "sanguo_rds" {
  count             = var.enable_rds ? 1 : 0
  
  engine           = "MySQL"
  engine_version   = "8.0"
  instance_type    = "rds.mysql.s2.large"
  instance_storage = 20
  vswitch_id       = alicloud_vswitch.sanguo_vswitch.id
  security_ips     = ["0.0.0.0/0"]
  db_instance_name = "sanguo-vnpy-${var.environment}-rds"
}

variable "enable_rds" {
  description = "是否启用 RDS 数据库"
  type        = bool
  default     = false
}

# =============================================================================
# 输出
# =============================================================================

output "vpc_id" {
  description = "VPC ID"
  value       = alicloud_vpc.sanguo_vpc.id
}

output "ecs_public_ip" {
  description = "ECS 公网 IP"
  value       = alicloud_instance.sanguo_ecs.public_ip
}

output "ecs_private_ip" {
  description = "ECS 私网 IP"
  value       = alicloud_instance.sanguo_ecs.private_ip
}

output "oss_bucket_name" {
  description = "OSS 存储桶名称"
  value       = alicloud_oss_bucket.sanguo_oss.bucket
}

output "ecs_ssh_command" {
  description = "SSH 连接命令"
  value       = "ssh root@${alicloud_instance.sanguo_ecs.public_ip}"
}

output "vnpy_web_url" {
  description = "vn.py Web 界面地址"
  value       = "http://${alicloud_instance.sanguo_ecs.public_ip}:8080"
}
