# https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs/resources/droplet
resource "digitalocean_droplet" "devserver" {
  name       = "devict-devserver"
  region     = var.region
  size       = "s-1vcpu-1gb"
  image      = "debian-13-x64"
  backups    = true
  monitoring = false
  ipv6       = false

  user_data = <<-EOT
    #cloud-config
    users:
      - name: devict
        groups: [sudo]
        shell: /bin/bash
        sudo: ALL=(ALL) NOPASSWD:ALL
        ssh_authorized_keys:
          - ${var.ssh_public_key}

    ssh_pwauth: false
    disable_root: true

    # Clear the password aging policy since we don't log in with passwords
    runcmd:
      - chage -d $(date +%Y-%m-%d) -m 0 -M 99999 -I -1 -E -1 devict
      - chage -d $(date +%Y-%m-%d) -m 0 -M 99999 -I -1 -E -1 root
  EOT
}

resource "digitalocean_firewall" "devserver" {
  name        = "devserver-firewall"
  droplet_ids = [digitalocean_droplet.devserver.id]

  inbound_rule {
    protocol         = "tcp"
    port_range       = "22"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # HTTP + HTTPS for Caddy (reverse proxy / TLS termination)
  inbound_rule {
    protocol         = "tcp"
    port_range       = "80"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  inbound_rule {
    protocol         = "tcp"
    port_range       = "443"
    source_addresses = ["0.0.0.0/0", "::/0"]
  }

  # Allow all egress (DNS, package updates, git, etc.). DO cloud firewalls
  # deny all outbound traffic when no outbound_rule blocks are present, so an
  # explicit allow-all is required. Keep the inbound side locked down instead.
  outbound_rule {
    protocol              = "tcp"
    port_range            = "all"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }

  outbound_rule {
    protocol              = "udp"
    port_range            = "all"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }

  outbound_rule {
    protocol              = "icmp"
    destination_addresses = ["0.0.0.0/0", "::/0"]
  }
}