# RDS PostgreSQL 16 for the ACCESS Core canonical ledger.

resource "aws_db_subnet_group" "this" {
  name       = "${var.name}-rds-subnets"
  subnet_ids = var.private_subnet_ids
  tags       = merge(var.tags, { Name = "${var.name}-rds-subnets" })
}

resource "aws_security_group" "rds" {
  name   = "${var.name}-rds-sg"
  vpc_id = var.vpc_id
  tags   = merge(var.tags, { Name = "${var.name}-rds-sg" })

  # Private subnets host only Fargate tasks and RDS; VPC-CIDR scoping avoids a
  # circular dependency between the database and ecs modules.
  ingress {
    description = "PostgreSQL from within the VPC (private subnets)"
    protocol    = "tcp"
    from_port   = 5432
    to_port     = 5432
    cidr_blocks = [var.vpc_cidr]
  }

  egress {
    description = "Allow all outbound (replication, extensions)"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_db_instance" "this" {
  identifier                = var.name
  engine                    = "postgres"
  engine_version            = "16"
  instance_class            = var.instance_class
  allocated_storage         = var.allocated_storage_gb
  max_allocated_storage     = var.max_allocated_storage_gb
  db_name                   = var.database_name
  username                  = var.username
  password                  = var.password
  db_subnet_group_name      = aws_db_subnet_group.this.name
  vpc_security_group_ids    = [aws_security_group.rds.id]
  multi_az                  = var.multi_az
  storage_encrypted         = var.storage_encrypted
  kms_key_id                = var.kms_key_id
  storage_type              = "gp3"
  backup_retention_period   = var.backup_retention_days
  deletion_protection       = var.deletion_protection
  skip_final_snapshot       = !var.final_snapshot
  final_snapshot_identifier = var.final_snapshot ? "${var.name}-final" : null
  apply_immediately         = true

  tags = merge(var.tags, { Name = var.name })
}