{% set config = merged_configs.get('azurerm_linux_web_app', {}) %}
{% set comments = compliance_comments.get('azurerm_linux_web_app', []) %}
# ------------------------------------------------------------------------------
# Azure Linux Web App (App Service)
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "azurerm_service_plan" "this" {
  name                = "{{ config.get('plan_name', project_id ~ '-plan') }}"
  resource_group_name = var.resource_group_name
  location            = var.region
  os_type             = "Linux"
  sku_name            = "{{ config.get('sku_name', 'P1v3') }}"

  tags = {
    Name      = "{{ config.get('plan_name', project_id ~ '-plan') }}"
    ManagedBy = "complyform"
  }
}

resource "azurerm_linux_web_app" "this" {
  name                = "{{ config.get('name', project_id ~ '-app') }}"
  resource_group_name = var.resource_group_name
  location            = var.region
  service_plan_id     = azurerm_service_plan.this.id

  https_only = {{ config.get('https_only', true) | lower }}

  site_config {
    minimum_tls_version = "{{ config.get('minimum_tls_version', '1.2') }}"
    http2_enabled       = {{ config.get('http2_enabled', true) | lower }}
    ftps_state          = "{{ config.get('ftps_state', 'Disabled') }}"

    {% if config.get('always_on', true) %}
    always_on = true
    {% endif %}

    {% if config.get('health_check_path') %}
    health_check_path = "{{ config.health_check_path }}"
    {% endif %}

    {% if config.get('application_stack') %}
    application_stack {
      {% if config.application_stack.get('python_version') %}
      python_version = "{{ config.application_stack.python_version }}"
      {% endif %}
      {% if config.application_stack.get('node_version') %}
      node_version = "{{ config.application_stack.node_version }}"
      {% endif %}
      {% if config.application_stack.get('docker_image_name') %}
      docker_image_name   = "{{ config.application_stack.docker_image_name }}"
      docker_registry_url = "{{ config.application_stack.get('docker_registry_url', '') }}"
      {% endif %}
    }
    {% endif %}

    {% if config.get('ip_restriction') %}
    {% for rule in config.ip_restriction %}
    ip_restriction {
      name       = "{{ rule.get('name', 'rule-' ~ loop.index) }}"
      ip_address = "{{ rule.get('ip_address', '') }}"
      action     = "{{ rule.get('action', 'Allow') }}"
      priority   = {{ rule.get('priority', loop.index * 100) }}
    }
    {% endfor %}
    {% endif %}
  }

  # Identity
  identity {
    type = "{{ config.get('identity_type', 'SystemAssigned') }}"
  }

  # Authentication
  {% if config.get('auth_enabled', false) %}
  auth_settings_v2 {
    auth_enabled = true
    require_authentication = true
    unauthenticated_action = "{{ config.get('unauthenticated_action', 'RedirectToLoginPage') }}"

    login {
      token_store_enabled = true
    }

    {% if config.get('active_directory') %}
    active_directory_v2 {
      client_id            = "{{ config.active_directory.client_id }}"
      tenant_auth_endpoint = "{{ config.active_directory.get('tenant_auth_endpoint', '') }}"
    }
    {% endif %}
  }
  {% endif %}

  # Logging
  logs {
    detailed_error_messages = {{ config.get('detailed_error_messages', true) | lower }}
    failed_request_tracing  = {{ config.get('failed_request_tracing', true) | lower }}

    http_logs {
      file_system {
        retention_in_days = {{ config.get('log_retention_days', 90) }}
        retention_in_mb   = {{ config.get('log_retention_mb', 100) }}
      }
    }
  }

  # Client certificate
  client_certificate_enabled = {{ config.get('client_certificate_enabled', false) | lower }}
  client_certificate_mode    = "{{ config.get('client_certificate_mode', 'Optional') }}"

  # App settings
  app_settings = {
    "WEBSITE_RUN_FROM_PACKAGE" = "{{ config.get('run_from_package', '1') }}"
    {% for key, value in config.get('app_settings', {}).items() %}
    "{{ key }}" = "{{ value }}"
    {% endfor %}
  }

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-app') }}"
    ManagedBy = "complyform"
  }
}
