{% extends "gcp/base_resource.tf.j2" %}
{% block resources %}
{% for firewall in resources %}

# Import existing firewall rule: {{ firewall.name }}
import {
  to = google_compute_firewall.{{ firewall.name_sanitized }}
  id = "{{ firewall.id }}"
}

{{ resource_spacer() }}
resource "google_compute_firewall" "{{ firewall.name_sanitized }}" {
  name     = "{{ firewall.name }}"
  network  = "{{ firewall.network }}"
  {% if firewall.description %}
  description = "{{ firewall.description }}"
  {%  endif %}

  direction = "{{ firewall.direction }}"
  priority  = {{ firewall.priority }}
  {% if firewall.disabled %}
  disabled  = true
  {%  endif %}

  {% if firewall.source_ranges %}
  source_ranges = {{ firewall.source_ranges | tojson }}
  {%  endif %}

  {% if firewall.source_tags %}
  source_tags = {{ firewall.source_tags | tojson }}
  {%  endif %}

  {% if firewall.source_service_accounts %}
  source_service_accounts = {{ firewall.source_service_accounts | tojson }}
  {%  endif %}

  {% if firewall.destination_ranges %}
  destination_ranges = {{ firewall.destination_ranges | tojson }}
  {%  endif %}

  {% if firewall.target_tags %}
  target_tags = {{ firewall.target_tags | tojson }}
  {%  endif %}

  {% if firewall.target_service_accounts %}
  target_service_accounts = {{ firewall.target_service_accounts | tojson }}
  {%  endif %}

  {% for rule in firewall.allow %}
  allow {
    protocol = "{{ rule.protocol }}"
    {% if rule.ports %}
    ports    = {{ rule.ports | tojson }}
    {%  endif %}
  }
  {% endfor %}

  {% for rule in firewall.deny %}
  deny {
    protocol = "{{ rule.protocol }}"
    {% if rule.ports %}
    ports    = {{ rule.ports | tojson }}
    {%  endif %}
  }
  {% endfor %}

  {% if firewall.enable_logging %}
  log_config {
    metadata = "INCLUDE_ALL_METADATA"
  }
  {%  endif %}

  lifecycle {
    prevent_destroy = true
  }
}

{% endfor %}
{% endblock %}
