data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}
data "openstack_networking_network_v2" "external" {
  name = var.external_network
}
resource "openstack_networking_network_v2" "private" {
  name           = "${var.app_name}-net"
  admin_state_up = true
}
resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.app_name}-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}
resource "openstack_networking_router_v2" "main" {
  name                = "${var.app_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}
resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.main.id
  subnet_id = openstack_networking_subnet_v2.private.id
}
resource "openstack_networking_secgroup_v2" "superset" {
  name        = "${var.app_name}-sg"
  description = "SSH, reverse-proxy HTTP/S, Superset UI 8088 restricted"
}
resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol  = "tcp"
  port_range_min = 22
  port_range_max = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.superset.id
}
resource "openstack_networking_secgroup_rule_v2" "http" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol  = "tcp"
  port_range_min = 80
  port_range_max = 80
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.superset.id
}
resource "openstack_networking_secgroup_rule_v2" "https" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol  = "tcp"
  port_range_min = 443
  port_range_max = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.superset.id
}
resource "openstack_networking_secgroup_rule_v2" "ui" {
  direction = "ingress"
  ethertype = "IPv4"
  protocol  = "tcp"
  port_range_min = 8088
  port_range_max = 8088
  remote_ip_prefix  = var.ui_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.superset.id
}
resource "openstack_networking_port_v2" "superset" {
  name               = "${var.app_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.superset.id]
  fixed_ip { subnet_id = openstack_networking_subnet_v2.private.id }
  depends_on = [openstack_networking_router_interface_v2.private]
}
resource "openstack_blockstorage_volume_v3" "data" {
  name = "${var.app_name}-data"
  size = var.volume_size
}
resource "openstack_compute_instance_v2" "superset" {
  name        = var.app_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name
  user_data = templatefile("${path.module}/cloud-init/superset.yaml.tftpl", { app_name = var.app_name })
  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 40
    boot_index            = 0
    delete_on_termination = true
  }
  network { port = openstack_networking_port_v2.superset.id }
}
resource "openstack_compute_volume_attach_v2" "data" {
  instance_id = openstack_compute_instance_v2.superset.id
  volume_id   = openstack_blockstorage_volume_v3.data.id
}
resource "openstack_networking_floatingip_v2" "superset" {
  pool = var.external_network
}
resource "openstack_networking_floatingip_associate_v2" "superset" {
  floating_ip = openstack_networking_floatingip_v2.superset.address
  port_id     = openstack_networking_port_v2.superset.id
}

variable "key_name" {
  description = "SSH keypair name (must already exist in your project)"
  type        = string
}
variable "flavor_name" {
  description = "Instance size. Superset stack runs on 2 vCPU and 8 GiB RAM."
  type        = string
  default     = "m2a.large"
}
variable "image_name" {
  type    = string
  default = "Ubuntu-24.04"
}
variable "app_name" {
  type    = string
  default = "superset"
}
variable "volume_size" {
  type    = number
  default = 40
}
variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}
variable "private_cidr" {
  type    = string
  default = "10.48.0.0/24"
}
variable "ui_allowed_cidr" {
  description = "CIDR allowed to reach Superset UI on port 8088."
  type        = string
  default     = "10.48.0.0/24"
}

#cloud-config
package_update: true
packages: [ca-certificates, curl, openssl]
write_files:
  - path: /opt/superset/docker-compose.yml
    content: |
      services:
        db:
          image: postgres:16
          restart: unless-stopped
          environment: {POSTGRES_DB: superset, POSTGRES_USER: superset}
          env_file: [/opt/superset/.env]
          volumes: [db_data:/var/lib/postgresql/data]
          healthcheck: {test: ["CMD-SHELL", "pg_isready -U superset"], interval: 5s, retries: 10}
        redis:
          image: redis:7
          restart: unless-stopped
          volumes: [redis_data:/data]
          healthcheck: {test: ["CMD", "redis-cli", "ping"], interval: 5s, retries: 10}
        superset:
          image: apache/superset:latest
          restart: unless-stopped
          ports: ["8088:8088"]
          env_file: [/opt/superset/.env]
          depends_on: {db: {condition: service_healthy}, redis: {condition: service_healthy}}
          volumes: [superset_home:/app/superset_home]
        superset-worker:
          image: apache/superset:latest
          restart: unless-stopped
          command: [celery, --app=superset.tasks.celery_app:app, worker, -O, fair, -l, INFO]
          env_file: [/opt/superset/.env]
          depends_on: {db: {condition: service_healthy}, redis: {condition: service_healthy}}
          volumes: [superset_home:/app/superset_home]
      volumes: {db_data: {}, redis_data: {}, superset_home: {}}
  - path: /opt/superset/init.sh
    permissions: "0755"
    content: |
      #!/bin/bash
      set -euo pipefail
      cd /opt/superset
      docker compose up -d db redis
      for i in $(seq 1 60); do docker compose exec -T db pg_isready -U superset && break; sleep 5; done
      docker compose run --rm superset superset db upgrade
      docker compose run --rm superset superset fab create-admin --username "$ADMIN_USERNAME" --firstname Admin --lastname User --email "$ADMIN_EMAIL" --password "$ADMIN_PASSWORD" || true
      docker compose run --rm superset superset init
      docker compose up -d
runcmd:
  - |
    set -e
    DEV=/dev/sdb
    for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
    if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L supersetdata "$DEV"; fi
    mkdir -p /var/lib/docker && mount "$DEV" /var/lib/docker
    grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/docker ext4 defaults,nofail 0 2" >> /etc/fstab
    curl -fsSL https://get.docker.com | sh
    DATABASE_PASSWORD=$(openssl rand -hex 24)
    SUPERSET_SECRET_KEY=$(openssl rand -hex 32)
    ADMIN_USERNAME=admin [email protected]
    ADMIN_PASSWORD=$(openssl rand -hex 16)
    cat > /opt/superset/.env <<EOF
    POSTGRES_PASSWORD=$DATABASE_PASSWORD
    DATABASE_PASSWORD=$DATABASE_PASSWORD
    SQLALCHEMY_DATABASE_URI=postgresql+psycopg2://superset:$DATABASE_PASSWORD@db:5432/superset
    REDIS_HOST=redis
    CELERY_BROKER_URL=redis://redis:6379/0
    CELERY_RESULT_BACKEND=redis://redis:6379/0
    SUPERSET_SECRET_KEY=$SUPERSET_SECRET_KEY
    SUPERSET_LOAD_EXAMPLES=no
    EOF
    chmod 600 /opt/superset/.env
    printf 'username: %s\npassword: %s\n' "$ADMIN_USERNAME" "$ADMIN_PASSWORD" > /opt/superset/.bootstrap-admin
    chmod 600 /opt/superset/.bootstrap-admin
    export ADMIN_USERNAME ADMIN_EMAIL ADMIN_PASSWORD
    /opt/superset/init.sh