# Azure VPN Gateway for Cross-Region Connectivity
# This module creates a VPN Gateway in West Europe (hub) to connect to US regions
# Alternative to ExpressRoute for Phase 1 deployment

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

# VPN Gateway in West Europe (hub region)
resource "azurerm_public_ip" "vpn_gateway" {
  name                = "az-p-wst-vpn-gateway-pip"
  location            = "westeurope"
  resource_group_name = var.resource_group_name
  allocation_method   = "Static"
  sku                 = "Standard"

  tags = var.tags
}

resource "azurerm_virtual_network_gateway" "vpn_gateway" {
  name                = "az-p-wst-vpn-gateway"
  location            = "westeurope"
  resource_group_name = var.resource_group_name

  type     = "Vpn"
  vpn_type = "RouteBased"

  active_active = false
  enable_bgp    = false
  sku           = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn_gateway.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = var.gateway_subnet_id
  }

  tags = var.tags
}

# Local Network Gateways for each US region
resource "azurerm_local_network_gateway" "us_regions" {
  for_each = var.us_region_vpn_configs

  name                = "az-p-wst-lng-${each.key}"
  location            = "westeurope"
  resource_group_name = var.resource_group_name

  gateway_address = each.value.gateway_address
  address_space   = each.value.address_space

  tags = var.tags
}

# VPN Connections from hub to each US region
resource "azurerm_virtual_network_gateway_connection" "us_regions" {
  for_each = var.us_region_vpn_configs

  name                = "az-p-wst-vpn-conn-${each.key}"
  location            = "westeurope"
  resource_group_name = var.resource_group_name

  type                       = "IPsec"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.vpn_gateway.id
  local_network_gateway_id  = azurerm_local_network_gateway.us_regions[each.key].id

  shared_key = each.value.shared_key

  tags = var.tags
}

