data "aws_availability_zones" "available" {
  state = "available"
}

resource "aws_vpc" "this" {
  cidr_block           = local.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "syslog-server-vpc"
  }
}

resource "aws_internet_gateway" "this" {
  vpc_id = aws_vpc.this.id

  tags = {
    Name = "syslog-server-igw"
  }
}

resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.this.id
  cidr_block              = local.public_subnet_cidr
  availability_zone       = data.aws_availability_zones.available.names[0]
  map_public_ip_on_launch = true

  tags = {
    Name = "syslog-server-public"
  }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.this.id

  tags = {
    Name = "syslog-server-public"
  }
}

resource "aws_route" "public_default" {
  route_table_id         = aws_route_table.public.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.this.id
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "this" {
  name        = "syslog-server"
  description = "Syslog collector - rsyslog 514 from office + VPC"
  vpc_id      = aws_vpc.this.id

  tags = {
    Name = "syslog-server"
  }
}

resource "aws_vpc_security_group_egress_rule" "all" {
  security_group_id = aws_security_group.this.id
  ip_protocol       = "-1"
  cidr_ipv4         = "0.0.0.0/0"
  description       = "All outbound for package installs and CloudWatch"
}

resource "aws_vpc_security_group_ingress_rule" "syslog_tcp" {
  for_each = toset(local.syslog_ingress_cidrs)

  security_group_id = aws_security_group.this.id
  ip_protocol       = "tcp"
  from_port         = 514
  to_port           = 514
  cidr_ipv4         = each.value
  description       = "syslog TCP 514"
}

resource "aws_vpc_security_group_ingress_rule" "syslog_udp" {
  for_each = toset(local.syslog_ingress_cidrs)

  security_group_id = aws_security_group.this.id
  ip_protocol       = "udp"
  from_port         = 514
  to_port           = 514
  cidr_ipv4         = each.value
  description       = "syslog UDP 514"
}

resource "aws_vpc_security_group_ingress_rule" "ssh" {
  for_each = toset(local.ssh_ingress_cidrs)

  security_group_id = aws_security_group.this.id
  ip_protocol       = "tcp"
  from_port         = 22
  to_port           = 22
  cidr_ipv4         = each.value
  description       = "SSH break-glass"
}

resource "aws_vpc_security_group_ingress_rule" "netflow_2055" {
  for_each = toset(local.office_cidrs)

  security_group_id = aws_security_group.this.id
  ip_protocol       = "udp"
  from_port         = 2055
  to_port           = 2055
  cidr_ipv4         = each.value
  description       = "netflow/sflow UDP 2055"
}

resource "aws_vpc_security_group_ingress_rule" "netflow_2056" {
  for_each = toset(local.office_cidrs)

  security_group_id = aws_security_group.this.id
  ip_protocol       = "udp"
  from_port         = 2056
  to_port           = 2056
  cidr_ipv4         = each.value
  description       = "netflow/sflow UDP 2056"
}