NovaSaaS Terraform Library

# aws/vpc/main.tf — NovaSaaS Platform
# Módulo VPC multi-AZ con subnets públicas/privadas

locals {
  common_tags = merge(
    {
      Project     = var.project
      Environment = var.environment
      ManagedBy   = "terraform"
      CostCenter  = var.cost_center
    },
    var.tags
  )
  nat_gateway_count = var.single_nat_gateway ? 1 : length(var.availability_zones)
}

resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = merge(local.common_tags, { Name = "${var.project}-${var.environment}-vpc" })
}

resource "aws_subnet" "private" {
  count             = length(var.private_subnet_cidrs)
  vpc_id            = aws_vpc.main.id
  cidr_block        = var.private_subnet_cidrs[count.index]
  availability_zone = var.availability_zones[count.index]

  tags = merge(local.common_tags, {
    Name                            = "${var.project}-${var.environment}-private-${count.index + 1}"
    Tier                            = "private"
    "kubernetes.io/role/internal-elb" = "1"
  })
}

resource "aws_subnet" "public" {
  count                   = length(var.public_subnet_cidrs)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = var.public_subnet_cidrs[count.index]
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = false

  tags = merge(local.common_tags, {
    Name                       = "${var.project}-${var.environment}-public-${count.index + 1}"
    Tier                       = "public"
    "kubernetes.io/role/elb"   = "1"
  })
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags   = merge(local.common_tags, { Name = "${var.project}-${var.environment}-igw" })
}

resource "aws_nat_gateway" "main" {
  count         = local.nat_gateway_count
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id

  tags = merge(local.common_tags, { Name = "${var.project}-${var.environment}-nat-${count.index + 1}" })
  depends_on = [aws_internet_gateway.main]
}

# VPC Flow Logs — habilitados por defecto para auditoría
resource "aws_flow_log" "main" {
  count          = var.enable_flow_logs ? 1 : 0
  iam_role_arn   = aws_iam_role.flow_log[0].arn
  log_destination = aws_cloudwatch_log_group.flow_log[0].arn
  traffic_type   = "ALL"
  vpc_id         = aws_vpc.main.id
}

variable "project" {
  description = "Nombre del proyecto (ej: novasaas)"
  type        = string
  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{1,18}[a-z0-9]$", var.project))
    error_message = "El nombre del proyecto debe ser lowercase, 3-20 chars, solo letras/numeros/guiones."
  }
}

variable "environment" {
  description = "Entorno de despliegue"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "El entorno debe ser: dev, staging o production."
  }
}

variable "cidr_block" {
  description = "CIDR block principal de la VPC"
  type        = string
  validation {
    condition     = can(cidrhost(var.cidr_block, 0))
    error_message = "El CIDR block debe ser notacion IPv4 valida (ej: 10.0.0.0/16)."
  }
}

variable "availability_zones" {
  description = "Lista de AZs a utilizar (minimo 2 para HA)"
  type        = list(string)
  validation {
    condition     = length(var.availability_zones) >= 2
    error_message = "Se requieren al menos 2 AZs para alta disponibilidad."
  }
}

variable "single_nat_gateway" {
  description = "Usar un solo NAT Gateway (ahorra costes en dev/staging)"
  type        = bool
  default     = false
}

variable "cost_center" {
  description = "Centro de coste para facturacion (ej: platform-team)"
  type        = string
  default     = "engineering"
}

variable "enable_flow_logs" {
  description = "Habilitar VPC Flow Logs para auditoria de trafico"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Tags adicionales a mergear con los comunes"
  type        = map(string)
  default     = {}
}