main.tf

#--------------------------------------------------------------
# Subnet IP Address Calculation (using Azure Verified Utility Module)
#--------------------------------------------------------------

# Calculate subnet address prefixes from the VNet address space
# This module dynamically allocates non-overlapping CIDR blocks
module "subnet_ip_addresses" {
  source  = "Azure/avm-utl-network-ip-addresses/azurerm"
  version = "0.1.0"

  address_space    = var.virtual_network_address_space
  address_prefixes = local.subnet_cidr_sizes[var.environment]

  # Efficient mode allocates larger subnets first to minimize fragmentation
  address_prefix_efficient_mode = true

  enable_telemetry = false
}

#--------------------------------------------------------------
# Network Security Group for Application Gateway
#--------------------------------------------------------------

# NSG with required rules for Application Gateway v2
# Reference: https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#required-security-rules
resource "azurerm_network_security_group" "appgw" {
  name                = local.appgw_nsg_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location

  #--------------------------------------------------------------
  # Inbound Rules
  #--------------------------------------------------------------

  # Allow HTTPS traffic from clients (port 443)
  security_rule {
    name                       = "Allow-HTTPS-Inbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    description                = "Allow HTTPS traffic from clients"
  }

  # Allow HTTP traffic from clients (port 80) - for redirect to HTTPS
  security_rule {
    name                       = "Allow-HTTP-Inbound"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    description                = "Allow HTTP traffic from clients (redirected to HTTPS)"
  }

  # Allow Gateway Manager traffic (required for Application Gateway v2 health)
  # Ports 65200-65535 are used for backend health communication
  security_rule {
    name                       = "Allow-GatewayManager-Inbound"
    priority                   = 200
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "65200-65535"
    source_address_prefix      = "GatewayManager"
    destination_address_prefix = "*"
    description                = "Required for Application Gateway v2 infrastructure communication"
  }

  # Allow Azure Load Balancer probes (required for health probes)
  security_rule {
    name                       = "Allow-AzureLoadBalancer-Inbound"
    priority                   = 300
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "AzureLoadBalancer"
    destination_address_prefix = "*"
    description                = "Required for Azure Load Balancer health probes"
  }

  # Deny all other inbound traffic
  security_rule {
    name                       = "Deny-All-Inbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    description                = "Deny all other inbound traffic"
  }

  #--------------------------------------------------------------
  # Outbound Rules
  #--------------------------------------------------------------

  # Allow outbound traffic to the internet (required for Application Gateway)
  security_rule {
    name                       = "Allow-Internet-Outbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "Internet"
    description                = "Required for Application Gateway outbound connectivity"
  }

  tags = {
    environment     = var.environment
    component       = "appgw-nsg"
  }
}

#--------------------------------------------------------------
# Network Security Group for API Management (Internal VNet mode)
#--------------------------------------------------------------

# NSG with required rules for APIM in Internal VNet deployment
# Reference: https://docs.azure.cn/en-us/api-management/virtual-network-reference
resource "azurerm_network_security_group" "apim" {
  name                = local.apim_nsg_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location

  #--------------------------------------------------------------
  # Inbound Rules (Required for Internal mode)
  #--------------------------------------------------------------

  # Management endpoint for Azure portal and PowerShell
  security_rule {
    name                       = "Allow-ApiManagement-Inbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "3443"
    source_address_prefix      = "ApiManagement"
    destination_address_prefix = "VirtualNetwork"
    description                = "Management endpoint for Azure portal and PowerShell"
  }

  # Azure Infrastructure Load Balancer
  security_rule {
    name                       = "Allow-AzureLoadBalancer-Inbound"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "6390"
    source_address_prefix      = "AzureLoadBalancer"
    destination_address_prefix = "VirtualNetwork"
    description                = "Azure Infrastructure Load Balancer health probe"
  }

  # Internal Azure Cache for Redis (optional but recommended for caching policies)
  security_rule {
    name                       = "Allow-Redis-Internal-Inbound"
    priority                   = 200
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "6381-6383"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "VirtualNetwork"
    description                = "Internal Azure Cache for Redis for caching policies between machines"
  }

  # Rate Limit sync counters (optional but recommended)
  security_rule {
    name                       = "Allow-RateLimit-Sync-Inbound"
    priority                   = 210
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Udp"
    source_port_range          = "*"
    destination_port_range     = "4290"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "VirtualNetwork"
    description                = "Sync counters for Rate Limit policies between machines"
  }

  # Deny all other inbound traffic
  security_rule {
    name                       = "Deny-All-Inbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
    description                = "Deny all other inbound traffic"
  }

  #--------------------------------------------------------------
  # Outbound Rules (Required for Internal mode)
  #--------------------------------------------------------------

  # Azure Storage dependency
  security_rule {
    name                       = "Allow-Storage-Outbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "Storage"
    description                = "Dependency on Azure Storage"
  }

  # Azure SQL dependency
  security_rule {
    name                       = "Allow-Sql-Outbound"
    priority                   = 110
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "1433"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "Sql"
    description                = "Access to Azure SQL endpoints"
  }

  # Azure Key Vault dependency
  security_rule {
    name                       = "Allow-KeyVault-Outbound"
    priority                   = 120
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "AzureKeyVault"
    description                = "Access to Azure Key Vault for secrets and certificates"
  }

  # Azure Monitor for diagnostics, metrics, and health
  security_rule {
    name                       = "Allow-AzureMonitor-Outbound"
    priority                   = 130
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_ranges    = ["443", "1886"]
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "AzureMonitor"
    description                = "Publish diagnostics logs, metrics, resource health, and Application Insights"
  }

  # TLS certificate validation (CRL/OCSP endpoints)
  security_rule {
    name                       = "Allow-CertificateValidation-Outbound"
    priority                   = 140
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_ranges    = ["80", "443"]
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "Internet"
    description                = "TLS certificate chain building and validation (CRL/OCSP endpoints)"
  }

  # Microsoft Entra ID (Azure AD) dependency
  security_rule {
    name                       = "Allow-AzureActiveDirectory-Outbound"
    priority                   = 150
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "AzureActiveDirectory"
    description                = "Microsoft Entra ID, Microsoft Graph, and Azure Key Vault dependency"
  }

  # Azure Event Hub for logging (optional but recommended)
  security_rule {
    name                       = "Allow-EventHub-Outbound"
    priority                   = 160
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_ranges    = ["443", "5671", "5672"]
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "EventHub"
    description                = "Dependency for Log to Azure Event Hubs policy and Azure Monitor"
  }

  # Internal Azure Cache for Redis - Outbound
  security_rule {
    name                       = "Allow-Redis-Internal-Outbound"
    priority                   = 200
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "6381-6383"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "VirtualNetwork"
    description                = "Internal Azure Cache for Redis for caching policies between machines"
  }

  # Rate Limit sync counters - Outbound
  security_rule {
    name                       = "Allow-RateLimit-Sync-Outbound"
    priority                   = 210
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "Udp"
    source_port_range          = "*"
    destination_port_range     = "4290"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "VirtualNetwork"
    description                = "Sync counters for Rate Limit policies between machines"
  }

  # DNS resolution
  security_rule {
    name                       = "Allow-DNS-Outbound"
    priority                   = 220
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "53"
    source_address_prefix      = "VirtualNetwork"
    destination_address_prefix = "*"
    description                = "DNS resolution for all Azure service dependencies"
  }

  tags = {
    environment     = var.environment
    component       = "apim-nsg"
  }
}

#--------------------------------------------------------------
# Subnets (using Azure Verified Module)
#--------------------------------------------------------------

# Create subnets for APIM, Application Gateway, and Private Endpoints
# using the AVM virtual network subnet submodule.
#
# Subnet sizes vary by environment:
#   - dev: /27 (32 addresses)
#   - stage/prod: /26 (64 addresses)
#
# Module source: Azure/avm-res-network-virtualnetwork/azurerm//modules/subnet
module "subnet" {
  source   = "Azure/avm-res-network-virtualnetwork/azurerm//modules/subnet"
  version  = "0.16.0"
  for_each = local.subnet_config

  name             = each.value.name
  parent_id        = local.virtual_network_resource_id
  address_prefixes = each.value.address_prefixes

  # Service delegations (e.g., for APIM)
  delegations = each.value.delegations

  # Service endpoints
  service_endpoints_with_location = each.value.service_endpoints

  # Private endpoint network policies
  private_endpoint_network_policies = each.value.private_endpoint_network_policies

  # Network Security Group association
  network_security_group = each.value.network_security_group

  depends_on = [
    azurerm_network_security_group.appgw,
    azurerm_network_security_group.apim
  ]
}

#--------------------------------------------------------------
# Azure Key Vault (using Azure Verified Module)
#--------------------------------------------------------------

# Key Vault for storing SSL certificates used by APIM and Application Gateway
# Uses Azure RBAC for authorization (recommended over access policies)
module "keyvault" {
  source  = "Azure/avm-res-keyvault-vault/azurerm"
  version = "0.10.0"

  name                = local.keyvault_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location
  tenant_id           = var.tenant_id

  # Use Standard SKU (Premium required only for HSM-backed keys)
  sku_name = "standard"

  # Soft delete and purge protection for production safety
  soft_delete_retention_days = 90
  purge_protection_enabled   = var.environment == "prod" ? true : false

  # Network ACLs - allow Azure services and the APIM and AppGW subnets
  network_acls = {
    bypass                     = "AzureServices"
    default_action             = "Deny"
    virtual_network_subnet_ids = [local.apim_subnet_id, local.appgw_subnet_id]
  }

  # Enable for ARM template deployment (needed for some automation scenarios)
  enabled_for_template_deployment = true

  # Role assignments for managed identities to access certificates
  role_assignments = {
    apim_secrets_user = {
      role_definition_id_or_name = "Key Vault Secrets User"
      principal_id               = azurerm_user_assigned_identity.apim.principal_id
      principal_type             = "ServicePrincipal"
    }
    apim_certificate_user = {
      role_definition_id_or_name = "Key Vault Certificate User"
      principal_id               = azurerm_user_assigned_identity.apim.principal_id
      principal_type             = "ServicePrincipal"
    }
    appgw_secrets_user = {
      role_definition_id_or_name = "Key Vault Secrets User"
      principal_id               = azurerm_user_assigned_identity.appgw.principal_id
      principal_type             = "ServicePrincipal"
    }
    appgw_certificate_user = {
      role_definition_id_or_name = "Key Vault Certificate User"
      principal_id               = azurerm_user_assigned_identity.appgw.principal_id
      principal_type             = "ServicePrincipal"
    }
  }

  # Disable telemetry
  enable_telemetry = false

  tags = {
    environment     = var.environment
    component       = "keyvault"
  }

}

#--------------------------------------------------------------
# User Assigned Managed Identities
#--------------------------------------------------------------

# User Assigned Identity for APIM (to access Key Vault)
resource "azurerm_user_assigned_identity" "apim" {
  name                = local.apim_user_assigned_identity_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location
}

# User Assigned Identity for Application Gateway (to access Key Vault)
resource "azurerm_user_assigned_identity" "appgw" {
  name                = local.appgw_user_assigned_identity_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location
}

#--------------------------------------------------------------
# API Management Service (using Azure Verified Module)
#--------------------------------------------------------------

# Only created when not in keyvault-only mode
module "apim" {
  source  = "Azure/avm-res-apimanagement-service/azurerm"
  version = "0.0.5"
  count   = var.deploy_keyvault_only ? 0 : 1

  name                = local.apim_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location
  publisher_email     = var.publisher_email
  publisher_name      = var.publisher_name

  # SKU configuration based on environment
  sku_name = "${local.apim_sku_by_environment[var.environment]}_1"

  # VNet integration - Internal mode (only accessible via private endpoint)
  virtual_network_type      = "Internal"
  virtual_network_subnet_id = local.apim_subnet_id

  # Disable public network access - only accessible via private endpoint
  public_network_access_enabled = false

  # Managed identity for Key Vault access
  managed_identities = {
    system_assigned            = false
    user_assigned_resource_ids = [azurerm_user_assigned_identity.apim.id]
  }

  # Custom domain configuration using Key Vault certificate
  # Configures all APIM endpoints: proxy (gateway), developer portal, management, and SCM
  hostname_configuration = {
    # Gateway/Proxy endpoint - main API endpoint
    proxy = [{
      host_name                       = var.custom_domain
      key_vault_id                    = local.keyvault_certificate_secret_id
      default_ssl_binding             = true
      negotiate_client_certificate    = false
      ssl_keyvault_identity_client_id = azurerm_user_assigned_identity.apim.client_id
    }]

    # Developer Portal endpoint
    developer_portal = [{
      host_name                       = var.custom_domain_developer_portal
      key_vault_id                    = local.keyvault_certificate_secret_id
      negotiate_client_certificate    = false
      ssl_keyvault_identity_client_id = azurerm_user_assigned_identity.apim.client_id
    }]

    # Management endpoint (for direct management API calls)
    management = [{
      host_name                       = var.custom_domain_management
      key_vault_id                    = local.keyvault_certificate_secret_id
      negotiate_client_certificate    = false
      ssl_keyvault_identity_client_id = azurerm_user_assigned_identity.apim.client_id
    }]

    # SCM endpoint (Git configuration repository)
    scm = [{
      host_name                       = var.custom_domain_scm
      key_vault_id                    = local.keyvault_certificate_secret_id
      negotiate_client_certificate    = false
      ssl_keyvault_identity_client_id = azurerm_user_assigned_identity.apim.client_id
    }]
  }

  # Private endpoint configuration
  private_endpoints = {
    primary = {
      name                          = "pe-${local.apim_name}"
      subnet_resource_id            = local.apim_subnet_id
      private_dns_zone_resource_ids = [local.private_dns_zone_ids.apim]
    }
  }

  # Diagnostic settings
  diagnostic_settings = {
    to_law = {
      name                  = "diag-law-${var.location}"
      workspace_resource_id = var.log_analytics_resource_id
    }
  }

  # Disable telemetry
  enable_telemetry = false

  tags = {
    environment     = var.environment
    component       = "apim"
  }

  depends_on = [
    module.keyvault
  ]
}

#--------------------------------------------------------------
# WAF Policy for Application Gateway
#--------------------------------------------------------------

# Only created when not in keyvault-only mode
resource "azurerm_web_application_firewall_policy" "this" {
  count = var.deploy_keyvault_only ? 0 : 1

  name                = local.waf_policy_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location

  policy_settings {
    enabled                     = true
    mode                        = "Prevention"
    request_body_check          = true
    file_upload_limit_in_mb     = 100
    max_request_body_size_in_kb = 128
  }

  managed_rules {
    managed_rule_set {
      type    = "OWASP"
      version = "3.2"
    }

    managed_rule_set {
      type    = "Microsoft_BotManagerRuleSet"
      version = "1.0"
    }
  }

  tags = {
    environment     = var.environment
    component       = "waf"
  }
}

#--------------------------------------------------------------
# Application Gateway (using Azure Verified Module)
#--------------------------------------------------------------

# Only created when not in keyvault-only mode
module "appgw" {
  source  = "Azure/avm-res-network-applicationgateway/azurerm"
  version = "0.4.3"
  count   = var.deploy_keyvault_only ? 0 : 1

  name                = local.appgw_name
  resource_group_name = var.apim_resource_group_name
  location            = var.location

  # WAF_v2 SKU
  sku = {
    name     = "WAF_v2"
    tier     = "WAF_v2"
  }

  autoscale_configuration = {
    min_capacity = local.appgw_autoscale_by_environment[var.environment].min_capacity
    max_capacity = local.appgw_autoscale_by_environment[var.environment].max_capacity
  }

  # Associate WAF policy
  app_gateway_waf_policy_resource_id = azurerm_web_application_firewall_policy.this[0].id

  # Gateway IP configuration (subnet)
  gateway_ip_configuration = {
    name      = "appgw-ip-config"
    subnet_id = local.appgw_subnet_id
  }

  # Managed identity for Key Vault access
  managed_identities = {
    system_assigned            = false
    user_assigned_resource_ids = [azurerm_user_assigned_identity.appgw.id]
  }

  # SSL certificates from Key Vault
  ssl_certificates = {
    custom_domain_cert = {
      name                = "custom-domain-cert"
      key_vault_secret_id = local.keyvault_certificate_secret_id
    }
  }

  # Frontend ports
  frontend_ports = {
    http = {
      name = "port-80"
      port = 80
    }
    https = {
      name = "port-443"
      port = 443
    }
  }

  # Backend address pools
  # For APIM pools, we use the private link FQDNs which resolve via the
  # privatelink.azure-api.net private DNS zone to APIM's private IP.
  # This provides a friendly name while avoiding circular routing.
  # Host headers are set via backend HTTP settings to the custom domains.
  backend_address_pools = {
    # Gateway/Proxy backend pool - uses APIM private link FQDN
    apim_gateway = {
      name  = "apim-gateway-backend-pool"
      fqdns = [local.apim_private_fqdn.gateway]
    }
    # Developer Portal backend pool - uses APIM private link FQDN
    apim_developer_portal = {
      name  = "apim-developer-portal-backend-pool"
      fqdns = [local.apim_private_fqdn.developer_portal]
    }
    # Management backend pool - uses APIM private link FQDN
    apim_management = {
      name  = "apim-management-backend-pool"
      fqdns = [local.apim_private_fqdn.management]
    }
    # SCM backend pool - uses APIM private link FQDN
    apim_scm = {
      name  = "apim-scm-backend-pool"
      fqdns = [local.apim_private_fqdn.scm]
    }
  }

  # Health probes
  # For APIM probes, we set explicit host headers since backends use IP addresses
  probe_configurations = {
    # Gateway/Proxy health probe
    apim_gateway_probe = {
      name                                      = "apim-gateway-health-probe"
      protocol                                  = "Https"
      path                                      = "/status-0123456789abcdef"
      interval                                  = 30
      timeout                                   = 30
      unhealthy_threshold                       = 3
      pick_host_name_from_backend_http_settings = true
      match = {
        status_code = ["200-399"]
      }
    }
    # Developer Portal health probe
    apim_developer_portal_probe = {
      name                                      = "apim-developer-portal-health-probe"
      protocol                                  = "Https"
      path                                      = "/signin"
      interval                                  = 30
      timeout                                   = 30
      unhealthy_threshold                       = 3
      pick_host_name_from_backend_http_settings = true
      match = {
        status_code = ["200-399"]
      }
    }
    # Management health probe
    apim_management_probe = {
      name                                      = "apim-management-health-probe"
      protocol                                  = "Https"
      path                                      = "/ServiceStatus"
      interval                                  = 30
      timeout                                   = 30
      unhealthy_threshold                       = 3
      pick_host_name_from_backend_http_settings = true
      match = {
        status_code = ["200-399"]
      }
    }
    # SCM health probe
    apim_scm_probe = {
      name                                      = "apim-scm-health-probe"
      protocol                                  = "Https"
      path                                      = "/"
      interval                                  = 30
      timeout                                   = 30
      unhealthy_threshold                       = 3
      pick_host_name_from_backend_http_settings = true
      match = {
        status_code = ["200-399"]
      }
    }
  }

  # Backend HTTP settings
  # For APIM backends, we explicitly set the host header to the custom domain
  # since we're connecting via private IP addresses.
  backend_http_settings = {
    # Gateway/Proxy HTTPS settings
    apim_gateway_https = {
      name                                = "apim-gateway-https-settings"
      port                                = 443
      protocol                            = "Https"
      cookie_based_affinity               = "Disabled"
      request_timeout                     = 60
      probe_name                          = "apim-gateway-health-probe"
      pick_host_name_from_backend_address = false
      host_name                           = var.custom_domain
    }
    # Developer Portal HTTPS settings
    apim_developer_portal_https = {
      name                                = "apim-developer-portal-https-settings"
      port                                = 443
      protocol                            = "Https"
      cookie_based_affinity               = "Disabled"
      request_timeout                     = 60
      probe_name                          = "apim-developer-portal-health-probe"
      pick_host_name_from_backend_address = false
      host_name                           = var.custom_domain_developer_portal
    }
    # Management HTTPS settings
    apim_management_https = {
      name                                = "apim-management-https-settings"
      port                                = 443
      protocol                            = "Https"
      cookie_based_affinity               = "Disabled"
      request_timeout                     = 60
      probe_name                          = "apim-management-health-probe"
      pick_host_name_from_backend_address = false
      host_name                           = var.custom_domain_management
    }
    # SCM HTTPS settings
    apim_scm_https = {
      name                                = "apim-scm-https-settings"
      port                                = 443
      protocol                            = "Https"
      cookie_based_affinity               = "Disabled"
      request_timeout                     = 60
      probe_name                          = "apim-scm-health-probe"
      pick_host_name_from_backend_address = false
      host_name                           = var.custom_domain_scm
    }
  }

  # HTTP listeners
  http_listeners = {
    #--------------------------------------------------------------
    # Gateway/Proxy listeners
    #--------------------------------------------------------------
    gateway_https_listener = {
      name                           = "gateway-https-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-443"
      protocol                       = "Https"
      ssl_certificate_name           = "custom-domain-cert"
      host_name                      = var.custom_domain
    }
    gateway_http_listener = {
      name                           = "gateway-http-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-80"
      protocol                       = "Http"
      host_name                      = var.custom_domain
    }

    #--------------------------------------------------------------
    # Developer Portal listeners
    #--------------------------------------------------------------
    developer_portal_https_listener = {
      name                           = "developer-portal-https-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-443"
      protocol                       = "Https"
      ssl_certificate_name           = "custom-domain-cert"
      host_name                      = var.custom_domain_developer_portal
    }
    developer_portal_http_listener = {
      name                           = "developer-portal-http-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-80"
      protocol                       = "Http"
      host_name                      = var.custom_domain_developer_portal
    }

    #--------------------------------------------------------------
    # Management listeners
    #--------------------------------------------------------------
    management_https_listener = {
      name                           = "management-https-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-443"
      protocol                       = "Https"
      ssl_certificate_name           = "custom-domain-cert"
      host_name                      = var.custom_domain_management
    }
    management_http_listener = {
      name                           = "management-http-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-80"
      protocol                       = "Http"
      host_name                      = var.custom_domain_management
    }

    #--------------------------------------------------------------
    # SCM listeners
    #--------------------------------------------------------------
    scm_https_listener = {
      name                           = "scm-https-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-443"
      protocol                       = "Https"
      ssl_certificate_name           = "custom-domain-cert"
      host_name                      = var.custom_domain_scm
    }
    scm_http_listener = {
      name                           = "scm-http-listener"
      frontend_ip_configuration_name = "appgw-public-frontend-ip"
      frontend_port_name             = "port-80"
      protocol                       = "Http"
      host_name                      = var.custom_domain_scm
    }
  }

  # Redirect configurations (HTTP to HTTPS for all domains)
  redirect_configuration = {
    gateway_http_to_https = {
      name                 = "gateway-http-to-https-redirect"
      redirect_type        = "Permanent"
      target_listener_name = "gateway-https-listener"
      include_path         = true
      include_query_string = true
    }
    developer_portal_http_to_https = {
      name                 = "developer-portal-http-to-https-redirect"
      redirect_type        = "Permanent"
      target_listener_name = "developer-portal-https-listener"
      include_path         = true
      include_query_string = true
    }
    management_http_to_https = {
      name                 = "management-http-to-https-redirect"
      redirect_type        = "Permanent"
      target_listener_name = "management-https-listener"
      include_path         = true
      include_query_string = true
    }
    scm_http_to_https = {
      name                 = "scm-http-to-https-redirect"
      redirect_type        = "Permanent"
      target_listener_name = "scm-https-listener"
      include_path         = true
      include_query_string = true
    }
  }

  # Request routing rules
  request_routing_rules = {
    #--------------------------------------------------------------
    # Gateway/Proxy routing - APIM (APIM fronts the backend servers)
    #--------------------------------------------------------------
    gateway_https_rule = {
      name                       = "gateway-https-routing-rule"
      rule_type                  = "Basic"
      http_listener_name         = "gateway-https-listener"
      backend_address_pool_name  = "apim-gateway-backend-pool"
      backend_http_settings_name = "apim-gateway-https-settings"
      priority                   = 100
    }
    gateway_http_redirect_rule = {
      name                        = "gateway-http-redirect-rule"
      rule_type                   = "Basic"
      http_listener_name          = "gateway-http-listener"
      redirect_configuration_name = "gateway-http-to-https-redirect"
      priority                    = 101
    }

    #--------------------------------------------------------------
    # Developer Portal routing - APIM
    #--------------------------------------------------------------
    developer_portal_https_rule = {
      name                       = "developer-portal-https-routing-rule"
      rule_type                  = "Basic"
      http_listener_name         = "developer-portal-https-listener"
      backend_address_pool_name  = "apim-developer-portal-backend-pool"
      backend_http_settings_name = "apim-developer-portal-https-settings"
      priority                   = 200
    }
    developer_portal_http_redirect_rule = {
      name                        = "developer-portal-http-redirect-rule"
      rule_type                   = "Basic"
      http_listener_name          = "developer-portal-http-listener"
      redirect_configuration_name = "developer-portal-http-to-https-redirect"
      priority                    = 201
    }

    #--------------------------------------------------------------
    # Management routing - APIM
    #--------------------------------------------------------------
    management_https_rule = {
      name                       = "management-https-routing-rule"
      rule_type                  = "Basic"
      http_listener_name         = "management-https-listener"
      backend_address_pool_name  = "apim-management-backend-pool"
      backend_http_settings_name = "apim-management-https-settings"
      priority                   = 300
    }
    management_http_redirect_rule = {
      name                        = "management-http-redirect-rule"
      rule_type                   = "Basic"
      http_listener_name          = "management-http-listener"
      redirect_configuration_name = "management-http-to-https-redirect"
      priority                    = 301
    }

    #--------------------------------------------------------------
    # SCM routing - APIM
    #--------------------------------------------------------------
    scm_https_rule = {
      name                       = "scm-https-routing-rule"
      rule_type                  = "Basic"
      http_listener_name         = "scm-https-listener"
      backend_address_pool_name  = "apim-scm-backend-pool"
      backend_http_settings_name = "apim-scm-https-settings"
      priority                   = 400
    }
    scm_http_redirect_rule = {
      name                        = "scm-http-redirect-rule"
      rule_type                   = "Basic"
      http_listener_name          = "scm-http-listener"
      redirect_configuration_name = "scm-http-to-https-redirect"
      priority                    = 401
    }
  }

  # SSL policy for TLS 1.2+
  ssl_policy = {
    policy_type          = "Predefined"
    policy_name          = "AppGwSslPolicy20220101S"
    min_protocol_version = "TLSv1_2"
  }

  # Diagnostic settings
  diagnostic_settings = {
    to_law = {
      name                  = "diag-law-${var.location}"
      workspace_resource_id = var.log_analytics_resource_id
    }
  }

  # Disable telemetry
  enable_telemetry = false

  # Zone redundancy
  zones = ["1", "2", "3"]

  tags = {
    environment     = var.environment
    component       = "appgw"
  }

  depends_on = [
    module.keyvault,
    module.apim
  ]
}

#--------------------------------------------------------------
# Autoscale Settings (stage and prod only, not in keyvault-only mode)
#--------------------------------------------------------------

# APIM Autoscale Settings
# Only created for stage/prod AND when not in keyvault-only mode
resource "azurerm_monitor_autoscale_setting" "apim" {
  count = !var.deploy_keyvault_only && contains(["stage", "prod"], var.environment) ? 1 : 0

  name                = "autoscale-${local.apim_name}"
  resource_group_name = var.apim_resource_group_name
  location            = var.location
  target_resource_id  = module.apim[0].resource_id

  profile {
    name = "default"

    capacity {
      default = 2
      minimum = 2
      maximum = 10
    }

    # Scale out rule - CPU >= 75%, add 2 units
    rule {
      metric_trigger {
        metric_name        = "Capacity"
        metric_resource_id = module.apim[0].resource_id
        time_grain         = "PT1M"
        statistic          = "Maximum"
        time_window        = "PT10M"
        time_aggregation   = "Maximum"
        operator           = "GreaterThanOrEqual"
        threshold          = 75
      }

      scale_action {
        direction = "Increase"
        type      = "ChangeCount"
        value     = "2"
        cooldown  = "PT10M"
      }
    }

    # Scale in rule - CPU < 40%, remove 1 unit
    rule {
      metric_trigger {
        metric_name        = "Capacity"
        metric_resource_id = module.apim[0].resource_id
        time_grain         = "PT1M"
        statistic          = "Maximum"
        time_window        = "PT10M"
        time_aggregation   = "Average"
        operator           = "LessThan"
        threshold          = 40
      }

      scale_action {
        direction = "Decrease"
        type      = "ChangeCount"
        value     = "1"
        cooldown  = "PT10M"
      }
    }
  }

  tags = {
    environment     = var.environment
    component       = "apim-autoscale"
  }
}