args:
  - name: app_certification
    label: SSL 证书
    widget: certificate-select
    optional: true
  - name: app_domain
    label: 域名
    widget: domain-input
    optional: true
    certId: ${app_certification.certId}

variable "app_certification" {
   type = object({
     certId = string
   })
}

variable "app_domain" {
   type = object({
     domain = string
   })
}

# 声明 CLB 实例
resource "tencentcloud_clb_instance" "open_clb" {
  # 负载均衡实例的网络类型，OPEN：公网，INTERNAL：内网
  network_type = "OPEN"
  # 安全组
  security_groups = [var.sg.security_group.id]
  # VPC
  vpc_id = var.app_target.vpc.id
  # 子网
  subnet_id = var.app_target.subnet.id
  # 启用默认放通，即 Target 放通来自 CLB 的流量
  load_balancer_pass_to_target = true
}

# 声明 CLB HTTPS 监听器
resource "tencentcloud_clb_listener" "https_listener" {
  clb_id        = tencentcloud_clb_instance.open_clb.id
  listener_name = "https_listener"
  # CLB 监听 443 端口，支持 HTTPS 访问
  port          = 443
  protocol      = "HTTPS"
  # 这里使用安装参数里声明的证书
  certificate_id       = var.app_certification.certId
  certificate_ssl_mode = "UNIDIRECTIONAL"
}

# 声明 CLB 转发规则
resource "tencentcloud_clb_listener_rule" "https_rule" {
  clb_id      = tencentcloud_clb_instance.open_clb.id
  listener_id = tencentcloud_clb_listener.https_listener.id
  # 这里配置为安装参数声明的域名，意思是当请求是这个域名的请求时，进行转发
  domain = var.app_domain.domain
  # 哪个路径转发，这里配置根路径，全站转发
  url = "/"
}

# 声明 CLB 后端服务绑定，将命中转发规则的流量，转发到 CVM
resource "tencentcloud_clb_attachment" "clb_backend" {
  clb_id      = tencentcloud_clb_instance.open_clb.id
  listener_id = tencentcloud_clb_listener.https_listener.id
  rule_id     = tencentcloud_clb_listener_rule.api_https_rule.id
  
  targets {
    # CVM 实例ID（需替换成真实的实例ID）
    instance_id = tencentcloud_instance.demo_cvm[0].id
    # 假设我们的 CVM 打开的是 3000 的 http 端口
    port = 3000
    # 权重
    weight = 100
  }
}