terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket         = "moja-kompanija-terraform-state"
    key            = "production/main.tfstate"
    region         = "eu-west-1"
    encrypt        = true
    use_lockfile   = true
  }
}

provider "aws" {
  region = var.aws_region
}

resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = var.instance_type

  tags = {
    Name        = "web-server-${var.environment}"
    Environment = var.environment
    ManagedBy   = "Terraform"
  }
}

terraform/
├── modules/
│   ├── vpc/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   ├── eks-cluster/
│   └── rds-postgres/
├── environments/
│   ├── dev/
│   │   ├── main.tf
│   │   └── terraform.tfvars
│   ├── staging/
│   └── prod/
│       ├── main.tf
│       └── terraform.tfvars
└── .terraform.lock.hcl

module "vpc" {
  source  = "terraform-google-modules/network/google"
  version = "~> 9.0"

  project_id   = var.project_id
  network_name = "moja-vpc-${var.environment}"

  subnets = [
    {
      subnet_name   = "subnet-app"
      subnet_ip     = "10.0.1.0/24"
      subnet_region = "europe-west1"
    },
    {
      subnet_name   = "subnet-db"
      subnet_ip     = "10.0.2.0/24"
      subnet_region = "europe-west1"
    }
  ]
}

# Pozivanje custom modula za Kubernetes klaster
module "gke_cluster" {
  source = "./modules/gke"

  project_id   = var.project_id
  network_id   = module.vpc.network_id
  environment  = var.environment
  node_count   = var.environment == "prod" ? 3 : 1
}

terraform {
  backend "s3" {
    bucket         = "moja-kompanija-terraform-states"
    key            = "production/vpc/terraform.tfstate"
    region         = "eu-west-1"
    encrypt        = true
    use_lockfile   = true  # Native S3 locking (Terraform 1.10+)
  }
}

# Kreiranje S3 bucketa sa verzionisanjem
resource "aws_s3_bucket" "terraform_state" {
  bucket = "moja-kompanija-terraform-states"
}

resource "aws_s3_bucket_versioning" "terraform_state" {
  bucket = aws_s3_bucket.terraform_state.id
  versioning_configuration {
    status = "Enabled"
  }
}

terraform {
  backend "gcs" {
    bucket  = "moja-kompanija-terraform-state"
    prefix  = "production/main"
  }
}

# GCS bucket sa versioning-om
resource "google_storage_bucket" "terraform_state" {
  name          = "moja-kompanija-terraform-state"
  location      = "EU"
  force_destroy = false

  versioning {
    enabled = true
  }

  uniform_bucket_level_access = true
}

# .github/workflows/terraform.yml
name: 'Terraform CI/CD'

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

jobs:
  terraform:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write  # Potrebno za OIDC

    steps:
      - uses: actions/checkout@v4

      # OIDC autentifikacija — bez dugovječnih kredencijala!
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: eu-west-1

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Terraform Init
        run: terraform init

      - name: Terraform Format Check
        run: terraform fmt -check -recursive

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        run: terraform plan -out=tfplan

      # Apply samo na main branchu, manuelno odobrenje
      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve tfplan

# .gitlab-ci.yml
image: hashicorp/terraform:1.10

variables:
  TF_ROOT: ${CI_PROJECT_DIR}/terraform
  TF_STATE_NAME: production
  # GitLab ugrađeni HTTP backend za state
  TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${TF_STATE_NAME}

stages:
  - validate
  - plan
  - apply

before_script:
  - cd ${TF_ROOT}
  - terraform init

validate:
  stage: validate
  script:
    - terraform fmt -check
    - terraform validate

plan:
  stage: plan
  script:
    - terraform plan -out=plan.tfplan
  artifacts:
    paths:
      - ${TF_ROOT}/plan.tfplan
    expire_in: 1 week

apply:
  stage: apply
  script:
    - terraform apply -auto-approve plan.tfplan
  dependencies:
    - plan
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      when: manual  # Manuelno odobrenje za produkciju

# environments/prod/main.tf

locals {
  environment = "prod"
  region      = "eu-west-1"
  common_tags = {
    Environment = local.environment
    ManagedBy   = "Terraform"
    Team        = "Platform"
  }
}

# VPC modul
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "vpc-${local.environment}"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = false  # HA u produkciji

  tags = local.common_tags
}

# EKS Kubernetes klaster
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "eks-${local.environment}"
  cluster_version = "1.30"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  eks_managed_node_groups = {
    general = {
      min_size     = 2
      max_size     = 10
      desired_size = 3
      instance_types = ["m5.large"]
    }
  }

  tags = local.common_tags
}

# RDS PostgreSQL baza podataka
module "rds" {
  source  = "./../../modules/rds-postgres"

  identifier     = "db-${local.environment}"
  vpc_id         = module.vpc.vpc_id
  subnet_ids     = module.vpc.private_subnets
  environment    = local.environment
  instance_class = "db.t3.medium"

  tags = local.common_tags
}