# SES domain verification and SMTP setup for dumpnet.chat

resource "aws_ses_domain_identity" "dumpnet" {
  domain = var.domain
}

resource "aws_ses_domain_dkim" "dumpnet" {
  domain = aws_ses_domain_identity.dumpnet.domain
}

# DKIM DNS records (3 required)
resource "aws_route53_record" "ses_dkim" {
  count   = 3
  zone_id = data.aws_route53_zone.dumpnet.zone_id
  name    = "${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}._domainkey.${var.domain}"
  type    = "CNAME"
  ttl     = 300
  records = ["${aws_ses_domain_dkim.dumpnet.dkim_tokens[count.index]}.dkim.amazonses.com"]
}

# Domain verification TXT record
resource "aws_route53_record" "ses_verification" {
  zone_id = data.aws_route53_zone.dumpnet.zone_id
  name    = "_amazonses.${var.domain}"
  type    = "TXT"
  ttl     = 300
  records = [aws_ses_domain_identity.dumpnet.verification_token]
}

resource "aws_ses_domain_identity_verification" "dumpnet" {
  domain = aws_ses_domain_identity.dumpnet.id
  depends_on = [aws_route53_record.ses_verification]
}

# SMTP credentials via IAM user
resource "aws_iam_user" "ses_smtp" {
  name = "${var.cluster_name}-ses-smtp"
}

resource "aws_iam_user_policy" "ses_smtp" {
  name = "ses-send"
  user = aws_iam_user.ses_smtp.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "ses:SendRawEmail"
      Resource = "*"
    }]
  })
}

resource "aws_iam_access_key" "ses_smtp" {
  user = aws_iam_user.ses_smtp.name
}

# Store SMTP credentials in Secrets Manager
# Note: SES SMTP password is derived from the IAM secret key, not the key itself
# The password must be calculated using the SES SMTP password algorithm
locals {
  ses_smtp_endpoint = "email-smtp.${var.aws_region}.amazonaws.com"
}

output "ses_smtp_endpoint" {
  value = local.ses_smtp_endpoint
}

output "ses_smtp_username" {
  value = aws_iam_access_key.ses_smtp.id
}

output "ses_smtp_password" {
  value     = aws_iam_access_key.ses_smtp.ses_smtp_password_v4
  sensitive = true
}