# Cloud for Sovereignty Landing Zone - Multi-Region Deployment
# Well-Architected Framework Implementation

terraform {
  required_version = ">= 1.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }

  # Backend configuration - use local state for initial deployment
  # Can be migrated to azurerm backend after first deployment
  # backend "azurerm" {
  #   resource_group_name  = "az-p-we-rg-tfstate-001"
  #   storage_account_name = "azpwetfstate001"
  #   container_name      = "tfstate"
  #   key                 = "cloud-sovereignty.terraform.tfstate"
  # }
}

# MAXIMUM PARALLELISM CONFIGURATION
# Terraform parallelism is set via command line:
#   terraform apply -parallelism=128  # Maximum (default is 10)
# This allows up to 128 concurrent operations (12.8x faster than default)
# Use deploy-max-parallel.sh or deploy-ultra-parallel.sh for maximum speed

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = true
    }
    key_vault {
      purge_soft_delete_on_destroy    = false
      recover_soft_deleted_key_vaults = true
    }
  }

  # Subscription ID from environment or variable
  subscription_id = var.subscription_id
}

# Local values for naming and region configuration
locals {
  cloud_provider = "az"
  env_code       = "p" # Production

  # All Non-US Commercial Azure Regions (filtered to available regions)
  # Note: Some regions may not be available in all subscriptions
  # All region codes are standardized to exactly 3 characters
  regions = {
    # Europe (available regions)
    belgiumcentral = { code = "bel", name = "Belgium Central" }
    francecentral  = { code = "frc", name = "France Central" }
    # francesouth         = { code = "frs", name = "France South" }  # Not available for RGs
    # germanynorth        = { code = "gno", name = "Germany North" }  # Not available for RGs
    germanywestcentral = { code = "gwc", name = "Germany West Central" }
    italynorth         = { code = "ita", name = "Italy North" }
    austriaeast  = { code = "aut", name = "Austria East" }  # Note: Log Analytics uses nearest supported region
    northeurope = { code = "nor", name = "North Europe" }
    norwayeast  = { code = "noe", name = "Norway East" }
    # norwaywest         = { code = "now", name = "Norway West" }  # Not available for RGs
    polandcentral    = { code = "pol", name = "Poland Central" }
    spaincentral     = { code = "spa", name = "Spain Central" }
    swedencentral    = { code = "swc", name = "Sweden Central" }
    switzerlandnorth = { code = "swn", name = "Switzerland North" }
    switzerlandwest  = { code = "swt", name = "Switzerland West" }
    uksouth          = { code = "uks", name = "UK South" }
    ukwest           = { code = "ukw", name = "UK West" }
    westeurope       = { code = "wst", name = "West Europe" }

    # Asia Pacific
    # australiacentral removed - Government/Sovereign region (not commercial)
    australiaeast      = { code = "aus", name = "Australia East" }
    australiasoutheast = { code = "ase", name = "Australia Southeast" }
    eastasia           = { code = "eas", name = "East Asia" }
    centralindia       = { code = "cin", name = "Central India" }
    southindia         = { code = "sin", name = "South India" }
    westindia          = { code = "win", name = "West India" } # Note: Limited Log Analytics support - using nearest supported region
    indonesiacentral   = { code = "idn", name = "Indonesia Central" }
    japaneast          = { code = "jpe", name = "Japan East" }
    japanwest          = { code = "jpw", name = "Japan West" }
    koreacentral       = { code = "kor", name = "Korea Central" }
    koreasouth         = { code = "kos", name = "Korea South" }
    malaysiawest       = { code = "mys", name = "Malaysia West" }
    newzealandnorth    = { code = "nzl", name = "New Zealand North" }
    southeastasia      = { code = "sea", name = "Southeast Asia" }

    # Middle East & Africa
    israelcentral    = { code = "ilc", name = "Israel Central" }
    qatarcentral     = { code = "qat", name = "Qatar Central" }
    southafricanorth = { code = "zaf", name = "South Africa North" }
    # southafricawest     = { code = "zaw", name = "South Africa West" }  # Not available for RGs
    # uaecentral          = { code = "uac", name = "UAE Central" }  # Not available for RGs
    uaenorth = { code = "uae", name = "UAE North" }

    # Americas (Non-US)
    brazilsouth = { code = "bra", name = "Brazil South" }
    # brazilsoutheast     = { code = "bse", name = "Brazil Southeast" }  # Not available for RGs
    canadacentral = { code = "can", name = "Canada Central" }
    canadaeast    = { code = "cae", name = "Canada East" }
    chilecentral  = { code = "chl", name = "Chile Central" }
    mexicocentral = { code = "mex", name = "Mexico Central" }
  }

  # Common tags
  common_tags = {
    Environment      = "production"
    Project          = "DeFi Oracle Meta Mainnet"
    ChainID          = "138"
    ManagedBy        = "Terraform"
    CostCenter       = "Blockchain"
    Owner            = "DevOps Team"
    NamingConvention = "az-env-region-resource-instance"
    SovereigntyZone  = "Non-US Commercial"
  }
}

# Variables are defined in variables.tf

# Determine which regions to deploy (exclude admin region from deployment)
locals {
  # Exclude admin region from deployment regions
  deployment_regions = var.enable_all_regions ? [for k in keys(local.regions) : k if k != var.admin_region] : [for r in var.selected_regions : r if r != var.admin_region]
  regions_to_deploy  = local.deployment_regions
}

# Module for per-region deployment
module "region_deployment" {
  source = "./modules/region"

  for_each = {
    for region in local.regions_to_deploy : region => local.regions[region]
  }

  region_name         = each.key
  region_code         = each.value.code
  region_display      = each.value.name
  cloud_provider      = local.cloud_provider
  env_code            = local.env_code
  subscription_id     = var.subscription_id
  common_tags         = local.common_tags
  deploy_aks_clusters = var.deploy_aks_clusters
  # Use region-specific validator count if defined, otherwise use default
  validator_count   = lookup(var.validator_counts, each.key, var.validator_count)
  validator_vm_size = var.validator_vm_size
  sentry_count      = var.sentry_count
  # sentry_vm_size removed - not used (sentries deployed as pods)
}

# Outputs
output "deployed_regions" {
  description = "List of deployed regions"
  value       = local.regions_to_deploy
}

output "region_resources" {
  description = "Resource information per region"
  value = {
    for region, config in module.region_deployment : region => {
      resource_groups = config.resource_groups
      networks        = config.networks
      key_vaults      = config.key_vaults
    }
  }
}

