# Exercise 2 — Compose registry modules into a network + compute stack (medium)
#
# Use the public registry module terraform-aws-modules/vpc/aws to build the
# network and wire its outputs into your own resources.
#
# STEP 1: module "vpc" pinned to "~> 5.0": name = local.name, cidr = "10.30.0.0/16",
#         3 AZs, public + private subnets, ONE NAT gateway per AZ in prod and a
#         single NAT gateway otherwise (single_nat_gateway / one_nat_gateway_per_az).
# STEP 2: a security group for app instances in module.vpc.vpc_id allowing 8080
#         only from a security group for the ALB.
# STEP 3: an aws_lb (application) in module.vpc.public_subnets.
# STEP 4: outputs: vpc_id, private_subnets, alb_dns_name.
# STEP 5 (comment): after `terraform init`, where is the module code stored, and
#         why must the version be pinned?

terraform {
  required_version = ">= 1.6"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region = "eu-west-1"
}

variable "environment" {
  type    = string
  default = "dev"
}

locals {
  name    = "petpal-${var.environment}"
  is_prod = var.environment == "prod"
  azs     = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
}

# TODO STEP 1

# TODO STEP 2

# TODO STEP 3

# TODO STEP 4

# STEP 5 answer:
#

# ---------------------------------------------------------------------------
# CHECKLIST:
# [ ] module "vpc" has source "terraform-aws-modules/vpc/aws" and version "~> 5.0".
# [ ] dev plan creates 1 NAT gateway; prod (-var environment=prod) creates 3.
# [ ] The app SG allows 8080 only from the ALB SG (source_security_group_id /
#     referenced_security_group_id), not from a CIDR.
# [ ] The ALB uses module.vpc.public_subnets; app resources would use private_subnets.
# [ ] STEP 5: modules are downloaded to .terraform/modules/; pinning prevents a
#     new release from silently changing resources on the next init -upgrade.
# ---------------------------------------------------------------------------