import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
import { tailscalePreauthKey } from "./config";

export const createSubnetRouter = (vpcId: string, subnetId: string) => {
  const ami = aws.ec2.getAmiOutput({
    filters: [
      {
        name: "name",
        values: ["amzn2-ami-hvm-*"],
      },
    ],
    owners: ["137112412989"], // This owner ID is Amazon
    mostRecent: true,
  });

  const tailscaleSecurityGroup = new aws.ec2.SecurityGroup(
    "tailscale-security-group",
    {
      vpcId: vpcId,
      ingress: [
        {
          protocol: "udp",
          fromPort: 41641,
          toPort: 41641,
          cidrBlocks: ["0.0.0.0/0"],
        },
      ],
      egress: [
        {
          protocol: "-1",
          fromPort: 0,
          toPort: 0,
          cidrBlocks: ["0.0.0.0/0"],
        },
      ],
    }
  );

  const role = new aws.iam.Role("tailscale-instance-role", {
    assumeRolePolicy: JSON.stringify({
      Version: "2012-10-17",
      Statement: [
        {
          Effect: "Allow",
          Principal: {
            Service: "ec2.amazonaws.com",
          },
          Action: "sts:AssumeRole",
        },
      ],
    }),
  });

  const policyAttachment = new aws.iam.RolePolicyAttachment(
    "tailscale-instance-role-policy-attachment",
    {
      role: role,
      policyArn: "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
    }
  );

  const instanceProfile = new aws.iam.InstanceProfile(
    "tailscale-instance-profile",
    {
      role: role.name,
    }
  );

  const subnetRouter = new aws.ec2.Instance(
    "tailscale-instance",
    {
      instanceType: aws.ec2.InstanceType.T2_Small,
      vpcSecurityGroupIds: [tailscaleSecurityGroup.id],
      subnetId: subnetId,
      ami: ami.apply((ami) => ami.id),
      // ami: "ami-0eee07c07718334aa",
      iamInstanceProfile: instanceProfile.name,
      userData: pulumi.interpolate`#!/bin/bash
        set -e
        sudo yum install -y yum-utils
        sudo yum-config-manager --add-repo https://pkgs.tailscale.com/stable/amazon-linux/2/tailscale.repo
        sudo yum install -y tailscale
        sudo systemctl enable --now tailscaled
        tailscale up --authkey=${tailscalePreauthKey}`,
      tags: {
        Name: "tailscale-subnet-router",
      },
    },
    {
      ignoreChanges: ["ami"],
    }
  );

  return subnetRouter.publicIp;
};