# ── Provider VPC: Tạo NLB + Endpoint Service ──────────────
resource "aws_lb" "provider_nlb" {
  name               = "provider-nlb"
  load_balancer_type = "network"
  internal           = true   # PHẢI là internal
  subnets            = [aws_subnet.provider_private.id]
}

resource "aws_vpc_endpoint_service" "my_service" {
  acceptance_required        = true   # Manual approve consumers
  network_load_balancer_arns = [aws_lb.provider_nlb.arn]

  # Whitelist AWS accounts được phép connect
  allowed_principals = [
    "arn:aws:iam::123456789012:root",  # Account A
    "arn:aws:iam::987654321098:root",  # Account B
  ]

  tags = { Name = "my-private-service" }
}

# Output: service_name để consumer dùng
output "endpoint_service_name" {
  value = aws_vpc_endpoint_service.my_service.service_name
  # → "com.amazonaws.vpce.ap-southeast-1.vpce-svc-xxx"
}

# ── Consumer VPC: Tạo Interface Endpoint ──────────────────
resource "aws_vpc_endpoint" "to_provider" {
  vpc_id            = aws_vpc.consumer.id
  service_name      = var.provider_service_name
  vpc_endpoint_type = "Interface"

  # ENI sẽ được tạo trong các subnet này
  subnet_ids        = [aws_subnet.consumer_private.id]
  security_group_ids = [aws_security_group.endpoint_sg.id]

  # Private DNS: resolve service hostname → ENI IP
  private_dns_enabled = true

  tags = { Name = "endpoint-to-provider" }
}

# Security Group cho endpoint — chỉ cho phép từ app servers
resource "aws_security_group" "endpoint_sg" {
  vpc_id = aws_vpc.consumer.id
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # Only internal
  }
}

# Output: DNS name để app dùng (thay vì IP trực tiếp)
output "endpoint_dns" {
  value = aws_vpc_endpoint.to_provider.dns_entry[0].dns_name
}

# ── Tạo Transit Gateway ───────────────────────────────────
resource "aws_ec2_transit_gateway" "main" {
  description                     = "Central TGW for all VPCs"
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"
  auto_accept_shared_attachments  = "disable"  # Manual approve
  dns_support                     = "enable"
  tags = { Name = "main-tgw" }
}

# ── Attach VPCs vào TGW ──────────────────────────────────
resource "aws_ec2_transit_gateway_vpc_attachment" "prod" {
  subnet_ids         = [aws_subnet.prod_tgw_subnet.id]
  transit_gateway_id = aws_ec2_transit_gateway.main.id
  vpc_id             = aws_vpc.prod.id
  tags = { Name = "prod-attachment" }
}

# ── Custom Route Table (segment traffic) ─────────────────
# Prod VPC không được route đến Dev VPC
resource "aws_ec2_transit_gateway_route_table" "prod_rt" {
  transit_gateway_id = aws_ec2_transit_gateway.main.id
  tags = { Name = "prod-route-table" }
}

resource "aws_ec2_transit_gateway_route" "to_shared" {
  destination_cidr_block         = "10.100.0.0/16"  # Shared Services VPC
  transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.prod_rt.id
  transit_gateway_attachment_id  = aws_ec2_transit_gateway_vpc_attachment.shared.id
}

# ── VPC Route Table: route đến TGW ───────────────────────
resource "aws_route" "vpc_to_tgw" {
  route_table_id         = aws_route_table.prod_private.id
  destination_cidr_block = "10.0.0.0/8"    # All internal traffic
  transit_gateway_id     = aws_ec2_transit_gateway.main.id
}