resource "azurerm_network_security_group" "db_nsg" {
  # No public IP on DB VM + NSG = two independent
  # enforcement layers blocking internet access.

  security_rule {
    name                  = "AllowMySQL"
    priority              = 100
    direction             = "Inbound"
    access                = "Allow"
    destination_port      = "3306"
    # app subnet only; nothing else can reach MariaDB
    source_address_prefix = "10.0.1.0/24"
  }
}

resource "azurerm_key_vault" "kv" {
  name      = "cloud-v3-kv"
  tenant_id = data.azurerm_client_config.current.tenant_id
  sku_name  = "standard"
  # DB password auto-generated by random_password resource,
  # stored here by tofu apply; never typed or on disk.
}

# Terraform writes the live IP into Ansible's inventory
# on every apply; no manual IP hunting after redeploy.
resource "local_file" "ansible_vars" {
  content  = "app_domain: \"${azurerm_public_ip.app_pip.ip_address}.nip.io\""
  filename = "group_vars/all/terraform_outputs.yml"
}

# Chicken-and-egg: certbot needs port 80 open to
# validate the domain, but the final nginx config
# references the cert that doesn't exist yet.
- name: Deploy HTTP-only nginx config
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  when: not cert_stat.stat.exists  # skip if cert already exists

- name: Obtain SSL certificate
  command: >
    certbot certonly --webroot -w /var/www/html
    -d {{ app_domain }} --non-interactive
  args:
    creates: /etc/letsencrypt/live/{{ app_domain }}/fullchain.pem

- name: Deploy HTTPS nginx config  # now the cert exists
  template:
    src: nginx_ssl.conf.j2
    dest: /etc/nginx/nginx.conf

# Equivalent to running mysql_secure_installation,
# but fully automated and idempotent.
- name: Remove anonymous users
  mysql_user:
    name: ''
    host_all: yes
    state: absent

- name: Disallow remote root login
  mysql_user:
    name: root
    host: '%'
    state: absent

- name: Bind MariaDB to internal subnet only
  copy:
    dest: /etc/mysql/mariadb.conf.d/99-bind.cnf
    content: |
      [mysqld]
      bind-address = {{ db_bind_address }}