# ===== terraform.tf =====
# Provider requirements. Versions were the current major on 2026-08-26;
# `~>` allows every minor and patch inside that major.
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# ===== providers.tf =====
# Credentials and region come from the environment unless you set
# them here. Derive does not write credentials into generated code.

provider "aws" {}

# ===== network.tf =====
# Generated by Derive.
# Only mapped properties are converted. Anything this tool could not
# translate faithfully is left below as a TODO carrying the original
# value -- review every one before applying.

resource "aws_vpc" "app_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
}

resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.app_vpc.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

resource "aws_subnet" "private_subnet" {
  vpc_id     = aws_vpc.app_vpc.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_internet_gateway" "internet_gateway" {
}

resource "aws_internet_gateway_attachment" "gateway_attachment" {
  vpc_id              = aws_vpc.app_vpc.id
  internet_gateway_id = aws_internet_gateway.internet_gateway.id
}

resource "aws_route_table" "public_route_table" {
  vpc_id = aws_vpc.app_vpc.id
}

resource "aws_route" "public_route" {
  route_table_id         = aws_route_table.public_route_table.id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.internet_gateway.id
  depends_on = [aws_internet_gateway_attachment.gateway_attachment]
}

resource "aws_lb" "app_load_balancer" {
  subnets         = [aws_subnet.public_subnet.id]
  security_groups = [aws_security_group.web_security_group.name]
}

# ===== compute.tf =====
# Generated by Derive.
# Only mapped properties are converted. Anything this tool could not
# translate faithfully is left below as a TODO carrying the original
# value -- review every one before applying.

resource "aws_instance" "app_instance" {
  instance_type          = "t3.micro"
  subnet_id              = aws_subnet.private_subnet.id
  iam_instance_profile   = aws_iam_instance_profile.app_instance_profile.name
  vpc_security_group_ids = [aws_security_group.web_security_group.name]
}

# ===== storage.tf =====
# Generated by Derive.
# Only mapped properties are converted. Anything this tool could not
# translate faithfully is left below as a TODO carrying the original
# value -- review every one before applying.

resource "aws_s3_bucket" "assets_bucket" {
  # TODO(an Fn::Sub naming something this template does not declare; Terraform interpolation can only reference what is in scope): bucket = "${Fn::Sub}"
}

# ===== database.tf =====
# Generated by Derive.
# Only mapped properties are converted. Anything this tool could not
# translate faithfully is left below as a TODO carrying the original
# value -- review every one before applying.

resource "aws_db_subnet_group" "db_subnet_group" {
  description = "app db subnets"
  subnet_ids  = [aws_subnet.private_subnet.id]
}

resource "aws_db_instance" "app_database" {
  engine                 = "postgres"
  instance_class         = "db.t3.micro"
  allocated_storage      = "20"
  db_subnet_group_name   = aws_db_subnet_group.db_subnet_group.id
  vpc_security_group_ids = [aws_security_group.db_security_group.id]
}

# ===== security.tf =====
# Generated by Derive.
# Only mapped properties are converted. Anything this tool could not
# translate faithfully is left below as a TODO carrying the original
# value -- review every one before applying.

resource "aws_security_group" "web_security_group" {
  description = "Allow HTTPS"
  vpc_id      = aws_vpc.app_vpc.id
  ingress     = [
    {
      from_port = 443
      to_port = 443
      protocol = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  ]
}

resource "aws_security_group" "db_security_group" {
  description = "Allow Postgres from web"
  vpc_id      = aws_vpc.app_vpc.id
  ingress     = [
    {
      from_port = 5432
      to_port = 5432
      protocol = "tcp"
      security_groups = [aws_security_group.web_security_group.name]
    }
  ]
}

resource "aws_iam_role" "app_role" {
  assume_role_policy = {
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  }
}

resource "aws_iam_instance_profile" "app_instance_profile" {
  role = [aws_iam_role.app_role.name]
}