data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "openstack_networking_network_v2" "private" {
  name           = "${var.app_name}-net"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.app_name}-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}

resource "openstack_networking_router_v2" "main" {
  name                = "${var.app_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.main.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "clickhouse" {
  name        = "${var.app_name}-sg"
  description = "SSH and HTTP/HTTPS for a reverse proxy; ClickHouse 8123 and 9000 restricted"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.clickhouse.id
}

resource "openstack_networking_secgroup_rule_v2" "http" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 80
  port_range_max    = 80
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.clickhouse.id
}

resource "openstack_networking_secgroup_rule_v2" "https" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.clickhouse.id
}

resource "openstack_networking_secgroup_rule_v2" "clickhouse_http" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 8123
  port_range_max    = 8123
  remote_ip_prefix  = var.client_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.clickhouse.id
}

resource "openstack_networking_secgroup_rule_v2" "clickhouse_native" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 9000
  port_range_max    = 9000
  remote_ip_prefix  = var.client_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.clickhouse.id
}

resource "openstack_networking_port_v2" "clickhouse" {
  name               = "${var.app_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.clickhouse.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_blockstorage_volume_v3" "data" {
  name = "${var.app_name}-data"
  size = var.volume_size
}

resource "openstack_compute_instance_v2" "clickhouse" {
  name        = var.app_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/clickhouse.yaml.tftpl", {
    app_name = var.app_name
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 40
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.clickhouse.id
  }
}

resource "openstack_compute_volume_attach_v2" "data" {
  instance_id = openstack_compute_instance_v2.clickhouse.id
  volume_id   = openstack_blockstorage_volume_v3.data.id
}

resource "openstack_networking_floatingip_v2" "clickhouse" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "clickhouse" {
  floating_ip = openstack_networking_floatingip_v2.clickhouse.address
  port_id     = openstack_networking_port_v2.clickhouse.id
}

variable "key_name" {
  description = "SSH keypair name (must already exist in your project)"
  type        = string
}

variable "flavor_name" {
  description = "Instance size. ClickHouse analytical workloads run comfortably on 2 vCPU and 8 GiB RAM. Size up for heavier query concurrency or larger in-memory working sets."
  type        = string
  default     = "m2a.large"
}

variable "image_name" {
  description = "Operating system image. Ubuntu 24.04 is the recommended base."
  type        = string
  default     = "Ubuntu-24.04"
}

variable "app_name" {
  description = "Display name prefix for compute and network resources"
  type        = string
  default     = "clickhouse"
}

variable "volume_size" {
  description = "Block volume size in GiB, mounted at /var/lib/docker so ClickHouse table data lives on a volume you can grow rather than on the boot disk."
  type        = number
  default     = 50
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  description = "CIDR for the private tenant network the instance lives in"
  type        = string
  default     = "10.49.0.0/24"
}

variable "client_allowed_cidr" {
  description = "CIDR allowed to reach ClickHouse on ports 8123 (HTTP) and 9000 (native). Defaults to the private network only, so the database stays off the public internet on its raw ports. Reach it over an SSH tunnel, from a peer on the private network, or (recommended) put a reverse proxy in front and use HTTPS on 443. To allow direct access from your workstation, set this to YOUR_IP/32."
  type        = string
  default     = "10.49.0.0/24"
}

output "instance_id" {
  description = "ID of the compute instance running ClickHouse"
  value       = openstack_compute_instance_v2.clickhouse.id
}

output "floating_ip" {
  description = "Public floating IP address of the ClickHouse host"
  value       = openstack_networking_floatingip_v2.clickhouse.address
}

output "private_ip" {
  description = "Private IP address of the instance"
  value       = openstack_compute_instance_v2.clickhouse.access_ip_v4
}

output "http_url" {
  description = "ClickHouse HTTP interface on port 8123. Reachable from client_allowed_cidr (the private network by default; tunnel over SSH, or put a reverse proxy in front and use HTTPS on 443)."
  value       = "http://${openstack_networking_floatingip_v2.clickhouse.address}:8123"
}

output "native_endpoint" {
  description = "ClickHouse native TCP endpoint on port 9000. Same reachability rules as http_url."
  value       = "${openstack_networking_floatingip_v2.clickhouse.address}:9000"
}

#cloud-config
package_update: true
packages:
  - ca-certificates
  - curl
  - openssl
write_files:
  - path: /opt/clickhouse/docker-compose.yml
    permissions: "0644"
    content: |
      services:
        clickhouse:
          image: clickhouse/clickhouse-server:latest
          restart: unless-stopped
          ports:
            - "8123:8123"
            - "9000:9000"
          env_file:
            - /opt/clickhouse/.env
          volumes:
            - clickhouse_data:/var/lib/clickhouse
            - clickhouse_logs:/var/log/clickhouse-server
      volumes:
        clickhouse_data:
        clickhouse_logs:
runcmd:
  - |
    set -e
    DEV=/dev/sdb
    for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
    if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L chdata "$DEV"; fi
    mkdir -p /var/lib/docker
    mount "$DEV" /var/lib/docker
    grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/docker ext4 defaults,nofail 0 2" >> /etc/fstab
    CLICKHOUSE_USER=default
    CLICKHOUSE_PASSWORD=$(openssl rand -hex 24)
    cat > /opt/clickhouse/.env <<EOF
    CLICKHOUSE_USER=$CLICKHOUSE_USER
    CLICKHOUSE_PASSWORD=$CLICKHOUSE_PASSWORD
    CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
    EOF
    chmod 600 /opt/clickhouse/.env
    printf 'username: %s\npassword: %s\n' "$CLICKHOUSE_USER" "$CLICKHOUSE_PASSWORD" > /opt/clickhouse/.bootstrap-user
    chmod 600 /opt/clickhouse/.bootstrap-user
    curl -fsSL https://get.docker.com | sh
    cd /opt/clickhouse
    docker compose up -d