{% set config = merged_configs.get('azurerm_mssql_server', {}) %}
{% set comments = compliance_comments.get('azurerm_mssql_server', []) %}
# ------------------------------------------------------------------------------
# Azure SQL Server
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "azurerm_mssql_server" "this" {
  name                = "{{ config.get('name', project_id ~ '-sql') }}"
  resource_group_name = var.resource_group_name
  location            = var.region
  version             = "{{ config.get('version', '12.0') }}"

  administrator_login          = "{{ config.get('administrator_login', 'sqladmin') }}"
  administrator_login_password = var.sql_admin_password

  minimum_tls_version = "{{ config.get('minimum_tls_version', '1.2') }}"

  public_network_access_enabled = {{ config.get('public_network_access_enabled', false) | lower }}

  {% if config.get('azuread_administrator') %}
  azuread_administrator {
    login_username = "{{ config.azuread_administrator.get('login_username', '') }}"
    object_id      = "{{ config.azuread_administrator.get('object_id', '') }}"
  }
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-sql') }}"
    ManagedBy = "complyform"
  }
}

resource "azurerm_mssql_server_transparent_data_encryption" "this" {
  server_id = azurerm_mssql_server.this.id
  {% if config.get('encryption_key_vault_key_id') %}
  key_vault_key_id = "{{ config.encryption_key_vault_key_id }}"
  {% endif %}
}

resource "azurerm_mssql_server_extended_auditing_policy" "this" {
  server_id                               = azurerm_mssql_server.this.id
  storage_endpoint                        = {{ config.get('audit_storage_endpoint', 'null') }}
  storage_account_access_key              = {{ config.get('audit_storage_access_key', 'null') }}
  storage_account_access_key_is_secondary = false
  retention_in_days                       = {{ config.get('audit_retention_days', 90) }}
  log_monitoring_enabled                  = {{ config.get('log_monitoring_enabled', true) | lower }}
}

resource "azurerm_mssql_firewall_rule" "allow_azure_services" {
  name             = "AllowAzureServices"
  server_id        = azurerm_mssql_server.this.id
  start_ip_address = "0.0.0.0"
  end_ip_address   = "0.0.0.0"
}

{% if config.get('vulnerability_assessment', true) %}
resource "azurerm_mssql_server_vulnerability_assessment" "this" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.this.id
  storage_container_path          = {{ config.get('va_storage_container_path', 'null') }}

  recurring_scans {
    enabled                   = true
    email_subscription_admins = {{ config.get('va_email_admins', true) | lower }}
  }
}

resource "azurerm_mssql_server_security_alert_policy" "this" {
  resource_group_name = var.resource_group_name
  server_name         = azurerm_mssql_server.this.name
  state               = "Enabled"
  retention_days      = {{ config.get('alert_retention_days', 90) }}
}
{% endif %}

variable "sql_admin_password" {
  description = "SQL Server administrator password"
  type        = string
  sensitive   = true
}
