# terraform.tf — vereiste providers declareren
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.90"
    }
    databricks = {
      source  = "databricks/databricks"
      version = "~> 1.40"
    }
  }
}

# Provider configuratie
provider "azurerm" {
  features {}
  subscription_id = var.subscription_id
  tenant_id       = var.tenant_id
}

provider "databricks" {
  host  = azurerm_databricks_workspace.main.workspace_url
  token = var.databricks_token
}
      

# Resource Group
resource "azurerm_resource_group" "data_platform" {
  name     = "rg-dataplatform-${var.environment}-${var.location_short}"
  location = var.location
  tags     = local.common_tags
}

# Azure Data Lake Storage Gen2
resource "azurerm_storage_account" "datalake" {
  name                     = "sadatalake${var.environment}${var.suffix}"
  resource_group_name      = azurerm_resource_group.data_platform.name
  location                 = azurerm_resource_group.data_platform.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  is_hns_enabled           = true  # Hierarchical Namespace = ADLS Gen2

  tags = local.common_tags
}

# Storage containers (filesystems in ADLS Gen2)
resource "azurerm_storage_data_lake_gen2_filesystem" "bronze" {
  name               = "bronze"
  storage_account_id = azurerm_storage_account.datalake.id
}

resource "azurerm_storage_data_lake_gen2_filesystem" "silver" {
  name               = "silver"
  storage_account_id = azurerm_storage_account.datalake.id
}

resource "azurerm_storage_data_lake_gen2_filesystem" "gold" {
  name               = "gold"
  storage_account_id = azurerm_storage_account.datalake.id
}

# Databricks Workspace
resource "azurerm_databricks_workspace" "main" {
  name                = "dbw-${var.project}-${var.environment}"
  resource_group_name = azurerm_resource_group.data_platform.name
  location            = azurerm_resource_group.data_platform.location
  sku                 = "premium"

  custom_parameters {
    no_public_ip                                         = true
    virtual_network_id                                   = azurerm_virtual_network.main.id
    private_subnet_name                                  = azurerm_subnet.private.name
    public_subnet_name                                   = azurerm_subnet.public.name
    private_subnet_network_security_group_association_id = azurerm_subnet_network_security_group_association.private.id
    public_subnet_network_security_group_association_id  = azurerm_subnet_network_security_group_association.public.id
  }

  tags = local.common_tags
}

# Key Vault voor secrets
resource "azurerm_key_vault" "main" {
  name                       = "kv-${var.project}-${var.environment}"
  location                   = azurerm_resource_group.data_platform.location
  resource_group_name        = azurerm_resource_group.data_platform.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "standard"
  purge_protection_enabled   = true
  soft_delete_retention_days = 90

  tags = local.common_tags
}
      

# variables.tf
variable "environment" {
  description = "Deployment omgeving: dev, test, acc, prod"
  type        = string
  validation {
    condition     = contains(["dev", "test", "acc", "prod"], var.environment)
    error_message = "Environment moet dev, test, acc of prod zijn."
  }
}

variable "location" {
  description = "Azure regio voor de resources"
  type        = string
  default     = "westeurope"
}

variable "project" {
  description = "Projectnaam, gebruikt in resource namen"
  type        = string
}

variable "allowed_ip_ranges" {
  description = "Lijst van toegestane IP-adressen voor firewall regels"
  type        = list(string)
  default     = []
}

variable "databricks_config" {
  description = "Configuratie object voor Databricks"
  type = object({
    sku          = string
    no_public_ip = bool
  })
  default = {
    sku          = "premium"
    no_public_ip = true
  }
}

# outputs.tf
output "databricks_workspace_url" {
  description = "URL van de Databricks workspace"
  value       = azurerm_databricks_workspace.main.workspace_url
}

output "storage_account_name" {
  description = "Naam van het ADLS Gen2 storage account"
  value       = azurerm_storage_account.datalake.name
}

output "key_vault_uri" {
  description = "URI van de Key Vault"
  value       = azurerm_key_vault.main.vault_uri
  sensitive   = false
}

# Locals voor herbruikbare waarden
locals {
  location_short = {
    "westeurope"  = "we"
    "northeurope" = "ne"
    "eastus"      = "eu"
  }[var.location]

  common_tags = {
    Environment = var.environment
    Project     = var.project
    ManagedBy   = "Terraform"
    Owner       = "DataTeam"
  }
}
      

# backend.tf — remote state in Azure Blob Storage
terraform {
  backend "azurerm" {
    resource_group_name  = "rg-terraform-state"
    storage_account_name = "saterraformstate001"
    container_name       = "tfstate"
    key                  = "dataplatform/prod/terraform.tfstate"
    use_oidc             = true  # Gebruik Azure AD workload identity (aanbevolen)
  }
}
      

# Gebruik een module uit het publieke registry
module "vnet" {
  source  = "Azure/vnet/azurerm"
  version = "~> 4.0"

  resource_group_name = azurerm_resource_group.data_platform.name
  vnet_location       = var.location
  address_space       = ["10.0.0.0/16"]
  subnet_names        = ["databricks-public", "databricks-private"]
  subnet_prefixes     = ["10.0.1.0/24", "10.0.2.0/24"]
}

# Gebruik een lokale module
module "databricks_workspace" {
  source = "./modules/databricks"

  environment         = var.environment
  resource_group_name = azurerm_resource_group.data_platform.name
  location            = var.location
  sku                 = "premium"
  vnet_id             = module.vnet.vnet_id
  public_subnet_name  = module.vnet.vnet_subnets[0]
  private_subnet_name = module.vnet.vnet_subnets[1]
}

# Output van de module gebruiken
output "workspace_url" {
  value = module.databricks_workspace.workspace_url
}
      

# 1. INIT: Providers downloaden en backend initialiseren
terraform init

# Init met backend config (voor CI/CD)
terraform init \
  -backend-config="storage_account_name=saterraformstate001" \
  -backend-config="container_name=tfstate" \
  -backend-config="key=prod/terraform.tfstate"

# 2. VALIDATE: Controleer of de configuratie syntactisch correct is
terraform validate

# 3. FORMAT: Formateer alle .tf bestanden consistent
terraform fmt -recursive

# 4. PLAN: Bekijk wat Terraform gaat doen ZONDER iets te wijzigen
terraform plan -out=tfplan

# Plan voor een specifieke workspace
terraform plan -var="environment=prod" -out=tfplan.prod

# 5. APPLY: Voer de wijzigingen door (vraagt bevestiging)
terraform apply tfplan

# Apply zonder bevestigingsvraag (voor CI/CD)
terraform apply -auto-approve tfplan

# 6. DESTROY: Verwijder ALLE resources in de state
terraform destroy

# Destroy alleen een specifieke resource
terraform destroy -target=azurerm_databricks_workspace.main

# Extra handige commando's
terraform show          # Toon huidige state leesbaar
terraform state list    # Lijst alle resources in state
terraform output        # Toon alle outputs
terraform refresh       # Sync state met werkelijke infrastructuur (verouderd, gebruik plan -refresh-only)
terraform import azurerm_resource_group.main /subscriptions/.../resourceGroups/rg-bestaand