# infrastructure/terraform/modules/network/main.tf

variable "environment" {
  type = string
}

variable "vpc_cidr" {
  type = string
}

locals {
  azs = ["${data.aws_region.current.name}a", "${data.aws_region.current.name}b", "${data.aws_region.current.name}c"]
}

resource "aws_vpc" "prestashop" {
  cidr_block           = var.vpc_cidr
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "prestashop-vpc-${var.environment}"
    Environment = var.environment
  }
}

# Subnets públicas para ALB
resource "aws_subnet" "public" {
  count             = 3
  vpc_id            = aws_vpc.prestashop.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index)
  availability_zone = local.azs[count.index]

  tags = {
    Name        = "prestashop-public-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

# Subnets privadas para aplicación
resource "aws_subnet" "private_app" {
  count             = 3
  vpc_id            = aws_vpc.prestashop.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index + 3)
  availability_zone = local.azs[count.index]

  tags = {
    Name        = "prestashop-private-app-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

# Subnets privadas para base de datos
resource "aws_subnet" "private_db" {
  count             = 3
  vpc_id            = aws_vpc.prestashop.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index + 6)
  availability_zone = local.azs[count.index]

  tags = {
    Name        = "prestashop-private-db-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

# Internet Gateway
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.prestashop.id

  tags = {
    Name        = "prestashop-igw-${var.environment}"
    Environment = var.environment
  }
}

# NAT Gateways
resource "aws_eip" "nat" {
  count = 3
  vpc   = true

  tags = {
    Name        = "prestashop-nat-eip-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_nat_gateway" "main" {
  count         = 3
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id

  tags = {
    Name        = "prestashop-nat-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

# Route Tables
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.prestashop.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name        = "prestashop-public-rt-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_route_table" "private" {
  count  = 3
  vpc_id = aws_vpc.prestashop.id

  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main[count.index].id
  }

  tags = {
    Name        = "prestashop-private-rt-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

# infrastructure/terraform/modules/efs/main.tf

resource "aws_efs_file_system" "prestashop" {
  creation_token = "prestashop-${var.environment}"
  encrypted      = true

  lifecycle_policy {
    transition_to_ia = "AFTER_30_DAYS"
  }

  performance_mode = "generalPurpose"
  throughput_mode  = "bursting"

  tags = {
    Name        = "prestashop-efs-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_efs_mount_target" "prestashop" {
  count           = length(var.private_subnet_ids)
  file_system_id  = aws_efs_file_system.prestashop.id
  subnet_id       = var.private_subnet_ids[count.index]
  security_groups = [aws_security_group.efs.id]
}

resource "aws_security_group" "efs" {
  name        = "prestashop-efs-${var.environment}"
  description = "Security group for PrestaShop EFS"
  vpc_id      = var.vpc_id

  ingress {
    description     = "NFS from EC2"
    from_port       = 2049
    to_port         = 2049
    protocol        = "tcp"
    security_groups = [var.app_security_group_id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name        = "prestashop-efs-sg-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_efs_backup_policy" "policy" {
  file_system_id = aws_efs_file_system.prestashop.id

  backup_policy {
    status = "ENABLED"
  }
}

# infrastructure/terraform/modules/aurora/main.tf

resource "aws_rds_cluster" "prestashop" {
  cluster_identifier     = "prestashop-${var.environment}"
  engine                = "aurora-mysql"
  engine_version        = "8.0.mysql_aurora.3.03.0"
  database_name         = "prestashop"
  master_username       = var.db_username
  master_password       = var.db_password
  skip_final_snapshot   = var.environment != "prod"
  
  vpc_security_group_ids = [aws_security_group.aurora.id]
  db_subnet_group_name   = aws_db_subnet_group.aurora.name
  
  backup_retention_period = var.environment == "prod" ? 30 : 7
  preferred_backup_window = "03:00-04:00"
  
  enabled_cloudwatch_logs_exports = ["error", "general", "slowquery"]
  
  serverlessv2_scaling_configuration {
    min_capacity = var.environment == "prod" ? 1.0 : 0.5
    max_capacity = var.environment == "prod" ? 8.0 : 2.0
  }

  tags = {
    Name        = "prestashop-aurora-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_rds_cluster_instance" "prestashop" {
  count               = var.environment == "prod" ? 2 : 1
  identifier          = "prestashop-${var.environment}-${count.index + 1}"
  cluster_identifier  = aws_rds_cluster.prestashop.id
  instance_class     = "db.serverless"
  engine             = aws_rds_cluster.prestashop.engine
  engine_version     = aws_rds_cluster.prestashop.engine_version

  performance_insights_enabled = true
  monitoring_interval         = 60
  
  tags = {
    Name        = "prestashop-aurora-instance-${count.index + 1}-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_security_group" "aurora" {
  name        = "prestashop-aurora-${var.environment}"
  description = "Security group for PrestaShop Aurora cluster"
  vpc_id      = var.vpc_id

  ingress {
    description     = "MySQL from EC2"
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [var.app_security_group_id]
  }

  tags = {
    Name        = "prestashop-aurora-sg-${var.environment}"
    Environment = var.environment
  }
}

# infrastructure/terraform/modules/elasticache/main.tf

resource "aws_elasticache_cluster" "prestashop" {
  cluster_id           = "prestashop-${var.environment}"
  engine              = "redis"
  node_type           = var.environment == "prod" ? "cache.t3.medium" : "cache.t3.micro"
  num_cache_nodes     = 1
  parameter_group_family = "redis6.x"
  port                = 6379
  
  subnet_group_name    = aws_elasticache_subnet_group.prestashop.name
  security_group_ids   = [aws_security_group.elasticache.id]
  
  maintenance_window   = "mon:01:00-mon:02:00"
  snapshot_window     = "02:00-03:00"
  snapshot_retention_period = var.environment == "prod" ? 7 : 1

  automatic_failover_enabled = var.environment == "prod"
  
  tags = {
    Name        = "prestashop-redis-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_elasticache_subnet_group" "prestashop" {
  name       = "prestashop-cache-subnet-${var.environment}"
  subnet_ids = var.private_subnet_ids
}

resource "aws_security_group" "elasticache" {
  name        = "prestashop-elasticache-${var.environment}"
  description = "Security group for PrestaShop ElastiCache"
  vpc_id      = var.vpc_id

  ingress {
    description     = "Redis from EC2"
    from_port       = 6379
    to_port         = 6379
    protocol        = "tcp"
    security_groups = [var.app_security_group_id]
  }

  tags = {
    Name        = "prestashop-elasticache-sg-${var.environment}"
    Environment = var.environment
  }
}

# infrastructure/terraform/modules/asg/launch_template.tf

resource "aws_launch_template" "prestashop" {
  name_prefix   = "prestashop-template-${var.environment}"
  image_id      = var.ami_id
  instance_type = var.environment == "prod" ? "t3.medium" : "t3.small"

  network_interfaces {
    associate_public_ip_address = false
    security_groups            = [aws_security_group.app.id]
  }

  iam_instance_profile {
    name = aws_iam_instance_profile.prestashop.name
  }

  user_data = base64encode(templatefile("${path.module}/scripts/user_data.sh", {
    environment     = var.environment
    efs_id         = var.efs_id
    region         = data.aws_region.current.name
    db_host        = var.db_endpoint
    db_name        = var.db_name
    db_user        = var.db_username
    db_password    = var.db_password
    redis_endpoint = var.redis_endpoint
  }))

  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      volume_size           = 20
      volume_type          = "gp3"
      delete_on_termination = true
      encrypted            = true
    }
  }

  monitoring {
    enabled = true
  }

  metadata_options {
    http_endpoint          = "enabled"
    http_tokens           = "required"
    instance_metadata_tags = "enabled"
  }

  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "prestashop-instance-${var.environment}"
      Environment = var.environment
    }
  }

  lifecycle {
    create_before_destroy = true
  }
}

# User data script
# scripts/user_data.sh
#!/bin/bash
yum update -y
yum install -y amazon-efs-utils nginx php-fpm

# Montar EFS
mkdir -p /var/www/prestashop
echo "${efs_id}:/ /var/www/prestashop efs _netdev,tls,iam 0 0" >> /etc/fstab
mount -a

# Configurar PHP
sed -i 's/memory_limit = 128M/memory_limit = 256M/' /etc/php.ini
sed -i 's/max_execution_time = 30/max_execution_time = 300/' /etc/php.ini
sed -i 's/upload_max_filesize = 2M/upload_max_filesize = 64M/' /etc/php.ini

# Configurar Nginx
cat > /etc/nginx/conf.d/prestashop.conf << 'EOL'
server {
    listen 80;
    server_name _;
    root /var/www/prestashop;
    
    client_max_body_size 64m;
    
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }
    
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php-fpm/www.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}
EOL

# Iniciar servicios
systemctl enable nginx php-fpm
systemctl start nginx php-fpm

# Configurar CloudWatch agent
yum install -y amazon-cloudwatch-agent
cat > /opt/aws/amazon-cloudwatch-agent/bin/config.json << 'EOL'
{
  "metrics": {
    "append_dimensions": {
      "AutoScalingGroupName": "${aws:AutoScalingGroupName}",
      "InstanceId": "${aws:InstanceId}"
    },
    "metrics_collected": {
      "disk": {
        "measurement": ["used_percent"],
        "resources": ["/"],
        "metrics_collection_interval": 60
      },
      "mem": {
        "measurement": ["mem_used_percent"],
        "metrics_collection_interval": 60
      }
    }
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/nginx/access.log",
            "log_group_name": "/prestashop/${environment}/nginx/access",
            "log_stream_name": "{instance_id}"
          },
          {
            "file_path": "/var/log/nginx/error.log",
            "log_group_name": "/prestashop/${environment}/nginx/error",
            "log_stream_name": "{instance_id}"
          },
          {
            "file_path": "/var/log/php-fpm/error.log",
            "log_group_name": "/prestashop/${environment}/php-fpm/error",
            "log_stream_name": "{instance_id}"
          }
        ]
      }
    }
  }
}
EOL

systemctl enable amazon-cloudwatch-agent
systemctl start amazon-cloudwatch-agent

# infrastructure/terraform/modules/asg/asg.tf

resource "aws_autoscaling_group" "prestashop" {
  name                = "prestashop-asg-${var.environment}"
  desired_capacity    = var.environment == "prod" ? 2 : 1
  max_size           = var.environment == "prod" ? 4 : 2
  min_size           = var.environment == "prod" ? 2 : 1
  target_group_arns  = [aws_lb_target_group.prestashop.arn]
  vpc_zone_identifier = var.private_subnet_ids
  health_check_type  = "ELB"
  health_check_grace_period = 300

  launch_template {
    id      = aws_launch_template.prestashop.id
    version = "$Latest"
  }

  instance_refresh {
    strategy = "Rolling"
    preferences {
      min_healthy_percentage = 50
    }
  }

  dynamic "tag" {
    for_each = {
      Name        = "prestashop-instance-${var.environment}"
      Environment = var.environment
    }
    content {
      key                 = tag.key
      value               = tag.value
      propagate_at_launch = true
    }
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_policy" "cpu" {
  name                   = "prestashop-cpu-policy-${var.environment}"
  autoscaling_group_name = aws_autoscaling_group.prestashop.name
  policy_type           = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    target_value = 70.0
  }
}

resource "aws_autoscaling_policy" "requests" {
  name                   = "prestashop-requests-policy-${var.environment}"
  autoscaling_group_name = aws_autoscaling_group.prestashop.name
  policy_type           = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ALBRequestCountPerTarget"
      resource_label        = "${aws_lb.prestashop.arn_suffix}/${aws_lb_target_group.prestashop.arn_suffix}"
    }
    target_value = 1000.0
  }
}

# infrastructure/terraform/modules/alb/main.tf

resource "aws_lb" "prestashop" {
  name               = "prestashop-alb-${var.environment}"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets           = var.public_subnet_ids

  enable_deletion_protection = var.environment == "prod"

  access_logs {
    bucket  = aws_s3_bucket.alb_logs.id
    prefix  = "alb-logs"
    enabled = true
  }

  tags = {
    Name        = "prestashop-alb-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.prestashop.arn
  port             = "80"
  protocol         = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.prestashop.arn
  port             = "443"
  protocol         = "HTTPS"
  ssl_policy       = "ELBSecurityPolicy-TLS-1-2-2017-01"
  certificate_arn  = var.certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.prestashop.arn
  }
}

resource "aws_lb_target_group" "prestashop" {
  name     = "prestashop-tg-${var.environment}"
  port     = 80
  protocol = "HTTP"
  vpc_id   = var.vpc_id

  health_check {
    enabled             = true
    healthy_threshold   = 2
    interval            = 30
    matcher            = "200"
    path               = "/healthcheck.php"
    port               = "traffic-port"
    timeout            = 5
    unhealthy_threshold = 2
  }

  stickiness {
    type            = "app_cookie"
    cookie_name     = "PrestaShopSession"
    cookie_duration = 86400
  }

  tags = {
    Name        = "prestashop-tg-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_security_group" "alb" {
  name        = "prestashop-alb-${var.environment}"
  description = "Security group for PrestaShop ALB"
  vpc_id      = var.vpc_id

  ingress {
    description = "HTTP"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "HTTPS"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name        = "prestashop-alb-sg-${var.environment}"
    Environment = var.environment
  }
}

# infrastructure/terraform/modules/cdn/main.tf

resource "aws_cloudfront_distribution" "prestashop" {
  enabled             = true
  is_ipv6_enabled    = true
  comment            = "PrestaShop CDN - ${var.environment}"
  price_class        = var.environment == "prod" ? "PriceClass_All" : "PriceClass_100"
  wait_for_deployment = false

  origin {
    domain_name = var.alb_domain_name
    origin_id   = "ALB"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }

    custom_header {
      name  = "X-Custom-Header"
      value = var.origin_custom_header
    }
  }

  origin {
    domain_name = var.s3_bucket_domain_name
    origin_id   = "S3-Media"

    s3_origin_config {
      origin_access_identity = aws_cloudfront_origin_access_identity.media.cloudfront_access_identity_path
    }
  }

  # Cache behavior for static assets
  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "ALB"

    forwarded_values {
      query_string = true
      cookies {
        forward = "whitelist"
        whitelisted_names = ["PrestaShop-*"]
      }
      headers = ["Host", "Authorization"]
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
    compress               = true

    function_association {
      event_type   = "viewer-request"
      function_arn = aws_cloudfront_function.security_headers.arn
    }
  }

  # Cache behavior for media
  ordered_cache_behavior {
    path_pattern     = "/img/*"
    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "S3-Media"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
    compress               = true
  }

  # Cache behavior for admin
  ordered_cache_behavior {
    path_pattern     = "/admin*"
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = "ALB"

    forwarded_values {
      query_string = true
      cookies {
        forward = "all"
      }
      headers = ["*"]
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 0
    max_ttl                = 0
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = var.certificate_arn
    minimum_protocol_version = "TLSv1.2_2021"
    ssl_support_method       = "sni-only"
  }

  web_acl_id = var.waf_web_acl_id

  tags = {
    Name        = "prestashop-cdn-${var.environment}"
    Environment = var.environment
  }
}

# CloudFront Function para Security Headers
resource "aws_cloudfront_function" "security_headers" {
  name    = "security-headers-${var.environment}"
  runtime = "cloudfront-js-1.0"
  code    = <<-EOT
function handler(event) {
    var response = event.response;
    var headers = response.headers;

    headers['strict-transport-security'] = { value: 'max-age=31536000; includeSubDomains; preload'};
    headers['x-content-type-options'] = { value: 'nosniff'};
    headers['x-frame-options'] = { value: 'DENY'};
    headers['x-xss-protection'] = { value: '1; mode=block'};
    headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin'};
    headers['content-security-policy'] = {
        value: "default-src 'self' *.prestashop.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.gstatic.com; style-src 'self' 'unsafe-inline' *.googleapis.com; img-src 'self' data: *.googleapis.com; font-src 'self' *.gstatic.com"
    };

    return response;
}
EOT
}

# infrastructure/terraform/modules/waf/main.tf

resource "aws_wafv2_web_acl" "prestashop" {
  name        = "prestashop-waf-${var.environment}"
  description = "WAF rules for PrestaShop"
  scope       = "CLOUDFRONT"

  default_action {
    allow {}
  }

  # SQL Injection Protection
  rule {
    name     = "SQLiProtection"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesSQLiRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "SQLiProtectionMetric"
      sampled_requests_enabled  = true
    }
  }

  # Common Attack Protection
  rule {
    name     = "CommonAttackProtection"
    priority = 2

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "CommonAttackProtectionMetric"
      sampled_requests_enabled  = true
    }
  }

  # Rate Limiting
  rule {
    name     = "RateLimit"
    priority = 3

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = var.environment == "prod" ? 2000 : 1000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "RateLimitMetric"
      sampled_requests_enabled  = true
    }
  }

  # Admin Path Protection
  rule {
    name     = "AdminProtection"
    priority = 4

    action {
      block {}
    }

    statement {
      and_statement {
        statements = [
          {
            byte_match_statement {
              search_string = "/admin"
              field_to_match {
                uri_path {}
              }
              text_transformation {
                priority = 1
                type     = "LOWERCASE"
              }
              positional_constraint = "STARTS_WITH"
            }
          },
          {
            not_statement {
              statement {
                ip_set_reference_statement {
                  arn = aws_wafv2_ip_set.admin_allowed_ips.arn
                }
              }
            }
          }
        ]
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name               = "AdminProtectionMetric"
      sampled_requests_enabled  = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name               = "PrestaShopWAFMetric"
    sampled_requests_enabled  = true
  }

  tags = {
    Name        = "prestashop-waf-${var.environment}"
    Environment = var.environment
  }
}

# IP Set para acceso admin
resource "aws_wafv2_ip_set" "admin_allowed_ips" {
  name               = "prestashop-admin-ips-${var.environment}"
  description        = "Allowed IPs for admin access"
  scope              = "CLOUDFRONT"
  ip_address_version = "IPV4"
  addresses          = var.admin_allowed_ips

  tags = {
    Name        = "prestashop-admin-ips-${var.environment}"
    Environment = var.environment
  }
}

# infrastructure/terraform/modules/dns/main.tf

resource "aws_acm_certificate" "prestashop" {
  provider = aws.us-east-1  # Certificado debe estar en us-east-1 para CloudFront
  domain_name       = var.domain_name
  validation_method = "DNS"
  subject_alternative_names = [
    "*.${var.domain_name}",
    "*.${var.environment}.${var.domain_name}"
  ]

  lifecycle {
    create_before_destroy = true
  }

  tags = {
    Name        = "prestashop-cert-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_route53_zone" "primary" {
  count = var.create_zone ? 1 : 0
  name  = var.domain_name

  tags = {
    Name        = "prestashop-zone-${var.environment}"
    Environment = var.environment
  }
}

resource "aws_route53_record" "validation" {
  for_each = {
    for dvo in aws_acm_certificate.prestashop.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  zone_id = var.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.record]
  ttl     = 60
}

resource "aws_route53_record" "www" {
  zone_id = var.zone_id
  name    = "www.${var.environment}.${var.domain_name}"
  type    = "A"

  alias {
    name                   = var.cloudfront_domain_name
    zone_id               = var.cloudfront_hosted_zone_id
    evaluate_target_health = false
  }
}

resource "aws_route53_record" "apex" {
  zone_id = var.zone_id
  name    = var.environment == "prod" ? var.domain_name : "${var.environment}.${var.domain_name}"
  type    = "A"

  alias {
    name                   = var.cloudfront_domain_name
    zone_id               = var.cloudfront_hosted_zone_id
    evaluate_target_health = false
  }
}

# Health Check
resource "aws_route53_health_check" "prestashop" {
  fqdn              = var.alb_domain_name
  port              = 443
  type              = "HTTPS"
  resource_path     = "/healthcheck.php"
  failure_threshold = "3"
  request_interval  = "30"

  tags = {
    Name        = "prestashop-health-${var.environment}"
    Environment = var.environment
  }
}