resource "google-compute-network" "vpc" {
  name                    = "vpcsim"
  auto-create-subnetworks = false
}

resource "google-compute-subnetwork" "frontend" {
  name          = "frontend"
  network       = google-compute-network.vpc.id
  ip-cidr-range = var.frontend-cidr
  region        = var.region
}

resource "google-compute-subnetwork" "backend" {
  name          = "backend"
  network       = google-compute-network.vpc.id
  ip-cidr-range = var.backend-cidr
  region        = var.region
}

resource "google-compute-subnetwork" "database" {
  name          = "database"
  network       = google-compute-network.vpc.id
  ip-cidr-range = var.database-cidr
  region        = var.region
}

resource "google-compute-firewall" "allow-http-https" {
  name    = "allow-http-https"
  network = google-compute-network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["80", "443"]
  }

  source-ranges = ["0.0.0.0/0"]
  target-tags   = ["web"]
}

resource "google-compute-firewall" "allow-ssh" {
  name    = "allow-ssh"
  network = google-compute-network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source-ranges = var.ssh-source-ranges
  target-tags   = ["ssh"]
}

resource "google-compute-firewall" "front-to-back" {
  name    = "front-to-back"
  network = google-compute-network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["8000"]
  }

  source-ranges = var.frontend-cidr
  target-tags   = ["backend"]
}

resource "google-compute-firewall" "back-to-db" {
  name    = "back-to-db"
  network = google-compute-network.vpc.id

  allow {
    protocol = "tcp"
    ports    = ["3306"]
  }

  source-ranges = var.backend-cidr
  target-tags   = ["database"]
}