module "my_app_ecr" {
  source = "./stdecr"

  # Required inputs
  name   = "my-application"
  region = "us-west-2"

  tags = {
    Environment = "production"
    Application = "my-app"
  }
}

# Get the repository ARN and name
output "ecr_arn" {
  value = module.my_app_ecr.arn
}

output "ecr_name" {
  value = module.my_app_ecr.name
}

output "ecr_url" {
  value = module.my_app_ecr.repository_url
}

module "secure_app_ecr" {
  source = "./stdecr"

  # Required inputs
  name   = "secure-application"
  region = "us-east-1"

  # Security configuration
  image_tag_mutability = "IMMUTABLE"
  scan_on_push         = true
  encryption_type      = "KMS"
  kms_key_id          = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"

  # Lifecycle policy
  enable_lifecycle_policy = true
  max_image_count        = 20
  untagged_image_days    = 3

  tags = {
    Environment = "production"
    Application = "secure-app"
    Compliance  = "required"
  }
}

# ECR repository with VPC endpoints for private access
# This enables ECS tasks without public IPs to access ECR
module "private_ecr" {
  source = "./stdecr"

  # Required inputs
  name   = "private-application"
  region = "us-west-2"

  # VPC Endpoints for private ECR access
  create_vpc_endpoints = true
  vpc_id              = "vpc-12345678"
  vpc_cidr_block      = "10.0.0.0/16"
  private_subnet_ids  = ["subnet-abcdef12", "subnet-21fedcba"]
  route_table_ids     = ["rtb-12345678", "rtb-87654321"]
  create_logs_endpoint = true  # Enable CloudWatch Logs endpoint

  tags = {
    Environment = "production"
    Purpose     = "private-access"
  }
}

# Custom repository policy for cross-account access
data "aws_iam_policy_document" "ecr_policy" {
  statement {
    sid    = "CrossAccountAccess"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::123456789012:root"]
    }

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability"
    ]
  }
}

module "shared_ecr" {
  source = "./stdecr"

  # Required inputs
  name   = "shared-application"
  region = "us-west-2"

  # Custom repository policy
  repository_policy = data.aws_iam_policy_document.ecr_policy.json

  tags = {
    Environment = "shared"
    Purpose     = "cross-account"
  }
}

# Frontend application
module "frontend_ecr" {
  source = "./stdecr"

  name   = "frontend-app"
  region = var.aws_region

  lifecycle_tag_prefixes = ["v", "release"]
  max_image_count       = 15

  tags = {
    Component = "frontend"
    Team      = "ui-team"
  }
}

# Backend API
module "backend_ecr" {
  source = "./stdecr"

  name   = "backend-api"
  region = var.aws_region

  image_tag_mutability = "IMMUTABLE"
  max_image_count     = 25

  tags = {
    Component = "backend"
    Team      = "api-team"
  }
}

# Database migrations
module "migrations_ecr" {
  source = "./stdecr"

  name   = "db-migrations"
  region = var.aws_region

  enable_lifecycle_policy = false  # Keep all migration images

  tags = {
    Component = "database"
    Team      = "data-team"
  }
}

# Create ECR repository with VPC endpoints
module "private_ecr" {
  source = "./stdecr"

  name   = "my-private-app"
  region = "us-west-2"

  # Enable VPC endpoints for private access
  create_vpc_endpoints = true
  vpc_id              = var.vpc_id
  vpc_cidr_block      = var.vpc_cidr_block
  private_subnet_ids  = var.private_subnet_ids
  route_table_ids     = var.route_table_ids
  create_logs_endpoint = true

  tags = {
    Environment = "production"
    Security    = "private-only"
  }
}

# Deploy ECS service without public IPs
module "private_service" {
  source = "./stdecsservice"

  docker_image   = "${module.private_ecr.repository_url}:latest"
  container_port = 8000

  # Disable public IPs (requires VPC endpoints)
  assign_public_ip = false
  internal_alb     = true

  service_name    = "my-private-app"
  cluster_id      = var.ecs_cluster_id
  vpc_id          = var.vpc_id
  private_subnets = var.private_subnets

  depends_on = [module.private_ecr]
}

# Create ECR repository
module "app_ecr" {
  source = "./stdecr"

  name   = "my-web-app"
  region = "us-west-2"
}

# Deploy to ECS using the ECR image
module "app_service" {
  source = "./stdecsservice"

  # Use the ECR repository URL as the Docker image
  docker_image   = "${module.app_ecr.repository_url}:latest"
  container_port = 8000

  service_name    = "my-web-app"
  cluster_id      = var.ecs_cluster_id
  vpc_id          = var.vpc_id
  private_subnets = var.private_subnets

  depends_on = [module.app_ecr]
}