data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "openstack_networking_network_v2" "private" {
  name           = "${var.app_name}-net"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.app_name}-subnet"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  dns_nameservers = ["1.1.1.1", "8.8.8.8"]
}

resource "openstack_networking_router_v2" "main" {
  name                = "${var.app_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.main.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "trino" {
  name        = "${var.app_name}-sg"
  description = "SSH and HTTP/HTTPS for a reverse proxy; editor port 8080 restricted"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.trino.id
}

# 80 and 443 carry the editor when it is served over a domain with automatic
# TLS through a reverse proxy (Caddy or Nginx). They are not used until you put
# a proxy in front of trino; see the reference page.
resource "openstack_networking_secgroup_rule_v2" "http" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 80
  port_range_max    = 80
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.trino.id
}

resource "openstack_networking_secgroup_rule_v2" "https" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.trino.id
}

# Raw editor HTTP on 8080 is restricted to ui_allowed_cidr (the private
# network by default). Prefer a domain with TLS on 443 for routine access.
# trino's own user management still gates the editor with an owner account set on
# first visit, but the port stays off the public internet by default.
resource "openstack_networking_secgroup_rule_v2" "editor" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 8080
  port_range_max    = 8080
  remote_ip_prefix  = var.ui_allowed_cidr
  security_group_id = openstack_networking_secgroup_v2.trino.id
}

resource "openstack_networking_port_v2" "trino" {
  name               = "${var.app_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.trino.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_blockstorage_volume_v3" "data" {
  name = "${var.app_name}-data"
  size = var.volume_size
}

resource "openstack_compute_instance_v2" "trino" {
  name        = var.app_name
  flavor_name = var.flavor_name
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/trino.yaml.tftpl", {
    app_name          = var.app_name
    worker_count      = var.worker_count
    postgres_host     = var.postgres_host
    postgres_port     = var.postgres_port
    postgres_database = var.postgres_database
    postgres_user     = var.postgres_user
    clickhouse_host   = var.clickhouse_host
    clickhouse_port   = var.clickhouse_port
    iceberg_rest_uri  = var.iceberg_rest_uri
    iceberg_warehouse = var.iceberg_warehouse
    s3_endpoint       = var.s3_endpoint
    s3_region         = var.s3_region
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 50
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.trino.id
  }
}

resource "openstack_compute_volume_attach_v2" "data" {
  instance_id = openstack_compute_instance_v2.trino.id
  volume_id   = openstack_blockstorage_volume_v3.data.id
}

resource "openstack_networking_floatingip_v2" "trino" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "trino" {
  floating_ip = openstack_networking_floatingip_v2.trino.address
  port_id     = openstack_networking_port_v2.trino.id
}

variable "key_name" {
  description = "SSH keypair name (must already exist in your project)"
  type        = string
}

variable "flavor_name" {
  description = "Instance size. Trino coordinator plus one worker runs on 4 vCPU and 16 GiB RAM."
  type        = string
  default     = "m2a.xlarge"
}

variable "image_name" {
  type    = string
  default = "Ubuntu-24.04"
}

variable "app_name" {
  type    = string
  default = "trino"
}

variable "volume_size" {
  type    = number
  default = 80
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  type    = string
  default = "10.50.0.0/24"
}

variable "ui_allowed_cidr" {
  description = "CIDR allowed to reach the Trino web UI on port 8080."
  type        = string
  default     = "10.50.0.0/24"
}

variable "worker_count" {
  type    = number
  default = 1

  validation {
    condition     = var.worker_count >= 1 && var.worker_count <= 3
    error_message = "worker_count must be between 1 and 3."
  }
}

variable "postgres_host" {
  type    = string
  default = ""
}

variable "postgres_port" {
  type    = number
  default = 5432
}

variable "postgres_database" {
  type    = string
  default = "analytics"
}

variable "postgres_user" {
  type    = string
  default = "analytics"
}

variable "clickhouse_host" {
  type    = string
  default = ""
}

variable "clickhouse_port" {
  type    = number
  default = 8123
}

variable "iceberg_rest_uri" {
  type    = string
  default = ""
}

variable "iceberg_warehouse" {
  type    = string
  default = "s3://lake/warehouse"
}

variable "s3_endpoint" {
  type    = string
  default = ""
}

variable "s3_region" {
  type    = string
  default = "us-east-1"
}

#cloud-config
package_update: true
packages: [ca-certificates, curl]
write_files:
  - path: /opt/trino/docker-compose.yml
    content: |
      services:
        trino-coordinator:
          image: trinodb/trino:463
          hostname: trino-coordinator
          restart: unless-stopped
          ports: ["8080:8080"]
          volumes:
            - /opt/trino/coordinator/etc:/etc/trino
            - /opt/trino/catalog:/etc/trino/catalog
            - trino-data:/data/trino
          networks: [trino-net]
        trino-worker-1:
          image: trinodb/trino:463
          hostname: trino-worker-1
          restart: unless-stopped
          depends_on: [trino-coordinator]
          volumes:
            - /opt/trino/worker-1/etc:/etc/trino
            - /opt/trino/catalog:/etc/trino/catalog
            - trino-data:/data/trino
          networks: [trino-net]
      volumes: {trino-data: {}}
      networks: {trino-net: {driver: bridge}}
  - path: /opt/trino/coordinator/etc/config.properties
    content: |
      coordinator=true
      node-scheduler.include-coordinator=false
      http-server.http.port=8080
      discovery.uri=http://trino-coordinator:8080
  - path: /opt/trino/coordinator/etc/node.properties
    content: |
      node.environment=${app_name}
      node.id=coordinator
      node.data-dir=/data/trino
  - path: /opt/trino/coordinator/etc/jvm.config
    content: |
      -server
      -Xmx8G
      -Xms8G
  - path: /opt/trino/worker-1/etc/config.properties
    content: |
      coordinator=false
      http-server.http.port=8080
      discovery.uri=http://trino-coordinator:8080
  - path: /opt/trino/worker-1/etc/node.properties
    content: |
      node.environment=${app_name}
      node.id=worker-1
      node.data-dir=/data/trino
  - path: /opt/trino/worker-1/etc/jvm.config
    content: |
      -server
      -Xmx6G
      -Xms6G
  - path: /opt/trino/catalog/tpch.properties
    content: |
      connector.name=tpch
      tpch.splits-per-node=4
%{ if postgres_host != "" ~}
  - path: /opt/trino/catalog/postgres.properties
    content: |
      connector.name=postgresql
      connection-url=jdbc:postgresql://${postgres_host}:${postgres_port}/${postgres_database}
      connection-user=${postgres_user}
%{ endif ~}
%{ if clickhouse_host != "" ~}
  - path: /opt/trino/catalog/clickhouse.properties
    content: |
      connector.name=clickhouse
      connection-url=jdbc:clickhouse://${clickhouse_host}:${clickhouse_port}/default
      connection-user=default
%{ endif ~}
%{ if iceberg_rest_uri != "" && s3_endpoint != "" ~}
  - path: /opt/trino/catalog/iceberg.properties
    content: |
      connector.name=iceberg
      iceberg.catalog.type=rest
      iceberg.rest-catalog.uri=${iceberg_rest_uri}
      iceberg.rest-catalog.warehouse=${iceberg_warehouse}
      fs.native-s3.enabled=true
      s3.endpoint=${s3_endpoint}
      s3.region=${s3_region}
      s3.path-style-access=true
%{ endif ~}
runcmd:
  - |
    set -e
    DEV=/dev/sdb
    for i in $(seq 1 30); do [ -b "$DEV" ] && break; sleep 5; done
    if ! blkid "$DEV" >/dev/null 2>&1; then mkfs.ext4 -F -L trinodata "$DEV"; fi
    mkdir -p /var/lib/docker && mount "$DEV" /var/lib/docker
    grep -q "$DEV" /etc/fstab || echo "$DEV /var/lib/docker ext4 defaults,nofail 0 2" >> /etc/fstab
    curl -fsSL https://get.docker.com | sh
    cd /opt/trino && docker compose up -d