data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "openstack_networking_network_v2" "private" {
  name           = "${var.app_name}-net"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.app_name}-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}

resource "openstack_networking_router_v2" "main" {
  name                = "${var.app_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.main.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "metabase" {
  name        = "${var.app_name}-sg"
  description = "SSH and HTTP/HTTPS for a reverse proxy; Metabase UI port 3000 restricted"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.metabase.id
}

# 80 and 443 carry the editor when it is served over a domain with automatic
# TLS through a reverse proxy (Caddy or Nginx). They are not used until you put
# a proxy in front of Metabase; see the reference page.
resource "openstack_networking_secgroup_rule_v2" "http" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 80
  port_range_max    = 80
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.metabase.id
}

resource "openstack_networking_secgroup_rule_v2" "https" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.metabase.id
}

# Raw Metabase UI HTTP on 3000 is restricted to editor_allowed_cidr (the private
# network by default). Prefer a domain with TLS on 443 for routine access.
# Metabase's setup wizard creates the admin account on first visit, but the port
# stays off the public internet by default.
resource "openstack_networking_secgroup_rule_v2" "editor" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 3000
  port_range_max    = 3000
  remote_ip_prefix  = var.editor_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.metabase.id
}

resource "openstack_networking_port_v2" "metabase" {
  name               = "${var.app_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.metabase.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_blockstorage_volume_v3" "data" {
  name = "${var.app_name}-data"
  size = var.volume_size
}

resource "openstack_compute_instance_v2" "metabase" {
  name        = var.app_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/metabase.yaml.tftpl", {
    app_name      = var.app_name
    db_type       = var.db_type
    postgres_host = var.postgres_host
    postgres_db   = var.postgres_db
    postgres_user = var.postgres_user
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 30
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.metabase.id
  }
}

resource "openstack_compute_volume_attach_v2" "data" {
  instance_id = openstack_compute_instance_v2.metabase.id
  volume_id   = openstack_blockstorage_volume_v3.data.id
}

resource "openstack_networking_floatingip_v2" "metabase" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "metabase" {
  floating_ip = openstack_networking_floatingip_v2.metabase.address
  port_id     = openstack_networking_port_v2.metabase.id
}

variable "key_name" {
  description = "SSH keypair name (must already exist in your project)"
  type        = string
}

variable "flavor_name" {
  description = "Instance size. Metabase with the embedded H2 app database runs on 2 vCPU and 2 GiB RAM. Size up for many concurrent users or when you point Metabase at an external Postgres app database."
  type        = string
  default     = "s1a.small"
}

variable "image_name" {
  description = "Operating system image. Ubuntu 24.04 is the recommended base."
  type        = string
  default     = "Ubuntu-24.04"
}

variable "app_name" {
  description = "Display name prefix for compute and network resources"
  type        = string
  default     = "metabase"
}

variable "volume_size" {
  description = "Block volume size in GiB, mounted at /var/lib/docker so Metabase application data lives on a volume you can grow rather than on the boot disk."
  type        = number
  default     = 20
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  description = "CIDR for the private tenant network the instance lives in"
  type        = string
  default     = "10.40.0.0/24"
}

variable "editor_allowed_cidr" {
  description = "CIDR allowed to reach the Metabase UI on port 3000. Defaults to the private network only. Reach it over an SSH tunnel, or serve it over HTTPS on 443 behind a reverse proxy. To allow direct access from your workstation, set this to YOUR_IP/32."
  type        = string
  default     = "10.40.0.0/24"
}

variable "db_type" {
  description = "Metabase application database. 'embedded' (default) stores app metadata in H2 on the data volume. 'postgres' points Metabase at an external PostgreSQL database for app metadata; supply postgres_* and set MB_DB_PASS in /opt/metabase/.env on the instance (never in tfvars)."
  type        = string
  default     = "embedded"

  validation {
    condition     = contains(["embedded", "postgres"], var.db_type)
    error_message = "db_type must be either \"embedded\" or \"postgres\"."
  }
}

variable "postgres_host" {
  description = "PostgreSQL host for db_type = \"postgres\" (for example the private IP of a self-managed-postgres instance). Ignored when db_type is embedded."
  type        = string
  default     = ""
}

variable "postgres_db" {
  description = "PostgreSQL database name for db_type = \"postgres\". Ignored when db_type is embedded."
  type        = string
  default     = "metabase"
}

variable "postgres_user" {
  description = "PostgreSQL user for db_type = \"postgres\". The password is never set here: add MB_DB_PASS to /opt/metabase/.env on the instance and restart. Ignored when db_type is embedded."
  type        = string
  default     = "metabase"
}

# Required: SSH keypair must already exist in your project
key_name = "YOUR_KEY_NAME"

# Recommended: restrict the UI (port 3000) to your workstation IP, or leave
# unset and tunnel over SSH, or put a reverse proxy in front on HTTPS.
# editor_allowed_cidr = "203.0.113.10/32"

# Application database: embedded (default, H2 on the data volume) or postgres
# (external Postgres for Metabase app metadata). Warehouse connections are
# configured in the Metabase UI after setup.
# db_type       = "postgres"
# postgres_host = "10.50.0.12"
# postgres_db   = "metabase"
# postgres_user = "metabase"

# flavor_name = "s1a.small"
# image_name = "Ubuntu-24.04"
# app_name = "metabase"
# volume_size = 20
# external_network = "PublicStatic"
# private_cidr = "10.40.0.0/24"

#cloud-config
package_update: true
packages:
  - ca-certificates
  - curl
write_files:
  - path: /opt/metabase/docker-compose.yml
    permissions: "0644"
    content: |
      services:
        metabase:
          image: metabase/metabase:latest
          restart: unless-stopped
          ports:
            - "3000:3000"
          env_file:
            - /opt/metabase/.env
          volumes:
            - metabase_data:/metabase-data
      volumes:
        metabase_data:
  - path: /opt/metabase/.env
    permissions: "0600"
    content: |
      # Metabase runtime configuration for ${app_name}.
      # You create the admin account on first visit. Application metadata
      # (questions, dashboards, users) lives on the metabase_data volume.
      MB_JETTY_PORT=3000
      JAVA_TIMEZONE=UTC
%{ if db_type == "postgres" ~}
      MB_DB_TYPE=postgres
      MB_DB_HOST=${postgres_host}
      MB_DB_PORT=5432
      MB_DB_DBNAME=${postgres_db}
      MB_DB_USER=${postgres_user}
      # Add MB_DB_PASS here on the instance and run `docker compose up -d`.
      # Never commit the password to tfvars or the repo:
      # MB_DB_PASS=
%{ else ~}
      # Embedded H2 application database on the metabase_data volume.
      MB_DB_FILE=/metabase-data/metabase.db
%{ endif ~}
runcmd:
  - |
    set -e
    DEV=/dev/sdb
    for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
    if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L metabasedata "$DEV"; fi
    mkdir -p /var/lib/docker
    mount "$DEV" /var/lib/docker
    grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/docker ext4 defaults,nofail 0 2" >> /etc/fstab
    curl -fsSL https://get.docker.com | sh
    cd /opt/metabase
    docker compose up -d