# 🤖 Production instance-hibernation state (issue #550 Part 4 v2 on the real
# fleet): the bucket activator-managed instances park in, and the router
# box's scoped credentials for it. Separate from the fleet-backup bucket —
# hibernation's embedded Litestream owns each managed DB's replication
# (deploy/fleet-backup.sh excludes those hosts; two replicators on one WAL
# would fight over checkpointing).

resource "aws_s3_bucket" "prod_instances" {
  bucket = "eleven-prod-instances-${local.account_id}"
}

resource "aws_s3_bucket_versioning" "prod_instances" {
  bucket = aws_s3_bucket.prod_instances.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "prod_instances" {
  bucket = aws_s3_bucket.prod_instances.id

  rule {
    id     = "expire-noncurrent-14d"
    status = "Enabled"

    filter {}

    noncurrent_version_expiration {
      noncurrent_days = 14
    }
  }
}

resource "aws_s3_bucket_public_access_block" "prod_instances" {
  bucket = aws_s3_bucket.prod_instances.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# TLS-only: deny any request arriving over plain HTTP. The activator's
# embedded Litestream and the stats publisher both speak HTTPS already —
# this turns that assumption into policy. A deny-only statement grants
# nothing public, so it attaches fine under the full access block above.
data "aws_iam_policy_document" "prod_instances_tls_only" {
  statement {
    sid     = "DenyInsecureTransport"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      aws_s3_bucket.prod_instances.arn,
      "${aws_s3_bucket.prod_instances.arn}/*",
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

resource "aws_s3_bucket_policy" "prod_instances" {
  bucket = aws_s3_bucket.prod_instances.id
  policy = data.aws_iam_policy_document.prod_instances_tls_only.json
}

# The router's activator credentials: object rw + version listing (the wake
# path restores, the lease CASes, sweepers may prune) on this bucket only.
# Key minted by hand, lives in the router's env — never in tofu state.
resource "aws_iam_user" "activator_prod" {
  name = "activator-prod"
}

data "aws_iam_policy_document" "activator_prod" {
  statement {
    sid       = "ListProdInstances"
    actions   = ["s3:ListBucket", "s3:ListBucketVersions"]
    resources = [aws_s3_bucket.prod_instances.arn]
  }

  statement {
    sid = "ReadWriteProdInstanceObjects"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:DeleteObjectVersion",
    ]
    resources = ["${aws_s3_bucket.prod_instances.arn}/*"]
  }
}

resource "aws_iam_user_policy" "activator_prod" {
  name   = "activator-prod-instances-bucket"
  user   = aws_iam_user.activator_prod.name
  policy = data.aws_iam_policy_document.activator_prod.json
}

output "prod_instances_bucket" {
  value = aws_s3_bucket.prod_instances.bucket
}