# Cloud CDN with Load Balancer Integration
resource "google_compute_global_address" "cdn_ip" {
  name = "cdn-global-ip"
}

resource "google_compute_managed_ssl_certificate" "cdn_ssl" {
  name = "cdn-ssl-cert"
  
  managed {
    domains = [var.domain_name, "www.${var.domain_name}"]
  }
}

resource "google_compute_backend_service" "web_backend" {
  name                  = "web-backend-service"
  protocol              = "HTTP"
  timeout_sec          = 30
  enable_cdn           = true
  
  # CDN configuration
  cdn_policy {
    cache_mode                   = "CACHE_ALL_STATIC"
    default_ttl                 = 3600
    max_ttl                     = 86400
    client_ttl                  = 7200
    negative_caching            = true
    serve_while_stale           = 86400
    
    # Custom cache key policy
    cache_key_policy {
      include_host           = true
      include_protocol       = true
      include_query_string   = false
      query_string_whitelist = ["version", "lang"]
      
      include_http_headers = [
        "Accept-Encoding",
        "Accept-Language"
      ]
    }
    
    # Negative caching policy
    negative_caching_policy {
      code = 404
      ttl  = 120
    }
    
    negative_caching_policy {
      code = 410
      ttl  = 3600
    }
  }
  
  backend {
    group                        = google_compute_instance_group.web_servers.self_link
    balancing_mode              = "UTILIZATION"
    max_utilization             = 0.8
    capacity_scaler             = 1.0
  }
  
  health_checks = [google_compute_health_check.web_health.id]
  
  # Custom request/response headers
  custom_request_headers = [
    "X-Client-Region:{client_region}",
    "X-Client-City:{client_city}"
  ]
  
  # Security headers
  custom_response_headers = [
    "X-Cache-Status:{cdn_cache_status}",
    "X-Cache-Id:{cdn_cache_id}"
  ]
}

# Backend bucket for static assets
resource "google_compute_backend_bucket" "static_assets" {
  name        = "static-assets-backend"
  bucket_name = google_storage_bucket.static_assets.name
  enable_cdn  = true
  
  cdn_policy {
    cache_mode       = "CACHE_ALL_STATIC"
    default_ttl     = 31536000  # 1 year
    max_ttl         = 31536000
    client_ttl      = 86400     # 1 day
    
    # Aggressive caching for static assets
    cache_key_policy {
      include_host         = false
      include_protocol     = false
      include_query_string = true
    }
    
    # CORS configuration
    bypass_cache_on_request_headers = [
      "Authorization",
      "Cookie"
    ]
  }
}

# URL Map for routing
resource "google_compute_url_map" "cdn_url_map" {
  name            = "cdn-url-map"
  default_service = google_compute_backend_service.web_backend.id
  
  host_rule {
    hosts        = [var.domain_name, "www.${var.domain_name}"]
    path_matcher = "main-matcher"
  }
  
  path_matcher {
    name            = "main-matcher"
    default_service = google_compute_backend_service.web_backend.id
    
    # Static assets routing
    path_rule {
      paths   = ["/static/*", "/assets/*", "/images/*"]
      service = google_compute_backend_bucket.static_assets.id
    }
    
    # API routing (different caching policy)
    path_rule {
      paths   = ["/api/*"]
      service = google_compute_backend_service.api_backend.id
    }
  }
}

# HTTPS Load Balancer
resource "google_compute_target_https_proxy" "cdn_proxy" {
  name             = "cdn-https-proxy"
  url_map          = google_compute_url_map.cdn_url_map.id
  ssl_certificates = [google_compute_managed_ssl_certificate.cdn_ssl.id]
  ssl_policy       = google_compute_ssl_policy.modern_ssl.id
}

resource "google_compute_global_forwarding_rule" "cdn_https" {
  name       = "cdn-https-rule"
  target     = google_compute_target_https_proxy.cdn_proxy.id
  port_range = "443"
  ip_address = google_compute_global_address.cdn_ip.id
}

# HTTP to HTTPS redirect
resource "google_compute_target_http_proxy" "cdn_http_proxy" {
  name    = "cdn-http-proxy"
  url_map = google_compute_url_map.https_redirect.id
}

resource "google_compute_url_map" "https_redirect" {
  name = "https-redirect"
  
  default_url_redirect {
    https_redirect         = true
    redirect_response_code = "MOVED_PERMANENTLY_DEFAULT"
    strip_query           = false
  }
}

resource "google_compute_global_forwarding_rule" "cdn_http" {
  name       = "cdn-http-rule"
  target     = google_compute_target_http_proxy.cdn_http_proxy.id
  port_range = "80"
  ip_address = google_compute_global_address.cdn_ip.id
}

# SSL Policy for modern security
resource "google_compute_ssl_policy" "modern_ssl" {
  name            = "modern-ssl-policy"
  profile         = "MODERN"
  min_tls_version = "TLS_1_2"
}

# Storage bucket for static assets
resource "google_storage_bucket" "static_assets" {
  name          = "${var.project_id}-static-assets"
  location      = "US"
  storage_class = "STANDARD"
  
  website {
    main_page_suffix = "index.html"
    not_found_page   = "404.html"
  }
  
  cors {
    origin          = ["*"]
    method          = ["GET", "HEAD"]
    response_header = ["Content-Type", "Cache-Control"]
    max_age_seconds = 3600
  }
  
  lifecycle_rule {
    condition {
      age = 365
    }
    action {
      type = "Delete"
    }
  }
}

# Cache invalidation automation
resource "google_cloudfunctions_function" "cache_invalidation" {
  name        = "cache-invalidation"
  runtime     = "python39"
  entry_point = "invalidate_cache"
  
  source_archive_bucket = google_storage_bucket.functions_source.name
  source_archive_object = google_storage_bucket_object.cache_function.name
  
  event_trigger {
    event_type = "google.storage.object.finalize"
    resource   = google_storage_bucket.static_assets.name
  }
  
  environment_variables = {
    CDN_URL_MAP = google_compute_url_map.cdn_url_map.name
  }
}

# Firebase project configuration
resource "google_firebase_project" "default" {
  provider = google-beta
  project  = var.project_id
}

resource "google_firebase_web_app" "basic" {
  provider     = google-beta
  project      = var.project_id
  display_name = var.app_display_name
  
  depends_on = [google_firebase_project.default]
}

# Custom domain configuration
resource "google_firebase_hosting_site" "default" {
  provider = google-beta
  project  = var.project_id
  site_id  = var.site_id
  
  depends_on = [google_firebase_project.default]
}

resource "google_firebase_hosting_custom_domain" "default" {
  provider    = google-beta
  project     = var.project_id
  site_id     = google_firebase_hosting_site.default.site_id
  custom_domain = var.custom_domain
  
  cert_preference = "GROUPED_CERT"
  
  depends_on = [
    google_firebase_hosting_site.default,
    google_dns_record_set.firebase_domain_verification
  ]
}

# DNS configuration for custom domain
resource "google_dns_managed_zone" "firebase_zone" {
  name     = "firebase-zone"
  dns_name = "${var.custom_domain}."
}

resource "google_dns_record_set" "firebase_domain_verification" {
  name = google_dns_managed_zone.firebase_zone.dns_name
  type = "TXT"
  ttl  = 300
  
  managed_zone = google_dns_managed_zone.firebase_zone.name
  
  rrdatas = [google_firebase_hosting_custom_domain.default.required_dns_updates[0].required_txt_record]
}

resource "google_dns_record_set" "firebase_a_record" {
  name = google_dns_managed_zone.firebase_zone.dns_name
  type = "A"
  ttl  = 300
  
  managed_zone = google_dns_managed_zone.firebase_zone.name
  
  rrdatas = ["199.36.158.100"]  # Firebase Hosting IP
}

# Security rules for Firebase
resource "google_firebase_hosting_release" "default" {
  provider = google-beta
  site_id  = google_firebase_hosting_site.default.site_id
  version_name = "v${formatdate("YYYYMMDD-hhmmss", timestamp())}"
  
  message = "Deployed via Terraform"
}

# Multi-tier caching strategy
resource "google_compute_region_backend_service" "api_backend" {
  name                  = "api-backend-service"
  protocol              = "HTTP"
  timeout_sec          = 30
  load_balancing_scheme = "EXTERNAL_MANAGED"
  
  # API-specific CDN configuration
  cdn_policy {
    cache_mode                   = "USE_ORIGIN_HEADERS"
    default_ttl                 = 0
    max_ttl                     = 3600
    client_ttl                  = 300
    negative_caching            = true
    serve_while_stale           = 86400
    
    # Custom cache key for API endpoints
    cache_key_policy {
      include_host             = true
      include_protocol         = true
      include_query_string     = true
      query_string_whitelist   = ["userId", "version", "locale"]
      
      include_http_headers = [
        "Authorization",
        "Accept-Language",
        "User-Agent"
      ]
    }
    
    # Bypass cache for authenticated requests
    bypass_cache_on_request_headers = [
      "Authorization",
      "Cookie"
    ]
    
    # Negative caching for API errors
    negative_caching_policy {
      code = 404
      ttl  = 300
    }
    
    negative_caching_policy {
      code = 500
      ttl  = 0
    }
  }
  
  backend {
    group                        = google_compute_instance_group.api_servers.self_link
    balancing_mode              = "RATE"
    max_rate_per_instance       = 100
    capacity_scaler             = 1.0
  }
}

# Edge-side includes configuration
resource "google_compute_backend_service" "esi_backend" {
  name       = "esi-backend-service"
  protocol   = "HTTP"
  enable_cdn = true
  
  cdn_policy {
    cache_mode       = "CACHE_ALL_STATIC"
    default_ttl     = 1800  # 30 minutes
    max_ttl         = 7200  # 2 hours
    
    # ESI configuration
    cache_key_policy {
      include_host         = true
      include_protocol     = false
      include_query_string = false
      
      # Include user segment for personalization
      include_http_headers = [
        "X-User-Segment",
        "X-Geo-Country"
      ]
    }
  }
  
  # Custom headers for ESI processing
  custom_request_headers = [
    "X-Edge-Cache: enabled",
    "X-ESI-Enabled: true"
  ]
}

# Fragment caching with surrogate keys
resource "google_compute_backend_service" "fragment_cache" {
  name       = "fragment-cache-service"
  protocol   = "HTTP"
  enable_cdn = true
  
  cdn_policy {
    cache_mode   = "USE_ORIGIN_HEADERS"
    default_ttl = 3600
    
    # Support for surrogate key invalidation
    signed_request_mode = "DISABLED"
    
    cache_key_policy {
      include_host         = true
      include_protocol     = false
      include_query_string = true
      
      # Fragment-specific cache keys
      query_string_whitelist = [
        "fragment",
        "version",
        "user_type"
      ]
    }
  }
  
  # Headers for fragment cache management
  custom_response_headers = [
    "Surrogate-Key: {fragment_type}",
    "Cache-Tag: {content_version}"
  ]
}

# Edge computing with Cloud Functions
resource "google_cloudfunctions_function" "edge_processor" {
  name        = "edge-content-processor"
  runtime     = "python39"
  entry_point = "process_edge_request"
  
  source_archive_bucket = google_storage_bucket.functions_source.name
  source_archive_object = google_storage_bucket_object.edge_function.name
  
  https_trigger {
    url = "https://${var.region}-${var.project_id}.cloudfunctions.net/edge-content-processor"
  }
  
  environment_variables = {
    CDN_CACHE_CONTROL = "max-age=3600"
    IMAGE_OPTIMIZATION = "enabled"
    COMPRESSION_LEVEL = "6"
  }
  
  # Regional deployment for edge computing
  region = var.region
}

# Image optimization at the edge
resource "google_cloudfunctions_function" "image_optimizer" {
  name        = "edge-image-optimizer"
  runtime     = "python39"
  entry_point = "optimize_image"
  
  source_archive_bucket = google_storage_bucket.functions_source.name
  source_archive_object = google_storage_bucket_object.image_optimizer.name
  
  https_trigger {
    url = "https://${var.region}-${var.project_id}.cloudfunctions.net/optimize-image"
  }
  
  environment_variables = {
    WEBP_QUALITY = "85"
    AVIF_QUALITY = "80"
    RESIZE_ALGORITHM = "lanczos"
    CACHE_TTL = "31536000"  # 1 year for optimized images
  }
}

# Real-time content personalization
resource "google_cloudfunctions_function" "content_personalizer" {
  name        = "edge-content-personalizer"
  runtime     = "nodejs18"
  entry_point = "personalizeContent"
  
  source_archive_bucket = google_storage_bucket.functions_source.name
  source_archive_object = google_storage_bucket_object.personalizer_function.name
  
  https_trigger {
    url = "https://${var.region}-${var.project_id}.cloudfunctions.net/personalize"
  }
  
  environment_variables = {
    PERSONALIZATION_API = google_apikeys_key.personalization_api.key_string
    USER_SEGMENT_TTL = "1800"  # 30 minutes
    CONTENT_CACHE_TTL = "300"  # 5 minutes
  }
}

# Cloud Armor security policy for CDN
resource "google_compute_security_policy" "cdn_security" {
  name = "cdn-security-policy"
  
  # Default rule - allow all traffic
  rule {
    action   = "allow"
    priority = "2147483647"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow rule"
  }
  
  # Rate limiting rule
  rule {
    action   = "rate_based_ban"
    priority = "1000"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
      
      rate_limit_threshold {
        count        = 100
        interval_sec = 60
      }
      
      ban_threshold {
        count        = 1000
        interval_sec = 300
      }
      
      ban_duration_sec = 3600
    }
    description = "Rate limiting rule"
  }
  
  # Geo-blocking rule
  rule {
    action   = "deny(403)"
    priority = "1100"
    match {
      expr {
        expression = "origin.region_code == 'CN' || origin.region_code == 'RU'"
      }
    }
    description = "Block specific regions"
  }
  
  # SQL injection protection
  rule {
    action   = "deny(403)"
    priority = "1200"
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('sqli-stable')"
      }
    }
    description = "SQL injection protection"
  }
  
  # XSS protection
  rule {
    action   = "deny(403)"
    priority = "1300"
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('xss-stable')"
      }
    }
    description = "XSS protection"
  }
}

# Apply security policy to backend service
resource "google_compute_backend_service" "secure_backend" {
  name            = "secure-backend-service"
  protocol        = "HTTP"
  enable_cdn      = true
  security_policy = google_compute_security_policy.cdn_security.id
  
  cdn_policy {
    cache_mode       = "CACHE_ALL_STATIC"
    default_ttl     = 3600
    signed_url_cache_max_age_sec = 3600
    
    # Secure cache key policy
    cache_key_policy {
      include_host         = true
      include_protocol     = true
      include_query_string = false
      
      # Exclude sensitive headers from cache key
      include_http_headers = []
    }
    
    # Negative caching for security
    negative_caching = true
    negative_caching_policy {
      code = 403
      ttl  = 120
    }
    negative_caching_policy {
      code = 404
      ttl  = 300
    }
  }
  
  # Security headers
  custom_response_headers = [
    "Strict-Transport-Security: max-age=31536000; includeSubDomains",
    "X-Content-Type-Options: nosniff",
    "X-Frame-Options: DENY",
    "X-XSS-Protection: 1; mode=block",
    "Referrer-Policy: strict-origin-when-cross-origin",
    "Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'"
  ]
}

# Signed URL generation for protected content
resource "google_storage_bucket" "protected_content" {
  name          = "${var.project_id}-protected-content"
  location      = "US"
  storage_class = "STANDARD"
  
  # Prevent public access
  uniform_bucket_level_access = true
  
  # Enable versioning for content integrity
  versioning {
    enabled = true
  }
  
  # Lifecycle management
  lifecycle_rule {
    condition {
      age = 7
    }
    action {
      type = "Delete"
    }
  }
}

# IAM for signed URL generation
resource "google_service_account" "signed_url_generator" {
  account_id   = "signed-url-generator"
  display_name = "Signed URL Generator Service Account"
}

resource "google_storage_bucket_iam_member" "signed_url_access" {
  bucket = google_storage_bucket.protected_content.name
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.signed_url_generator.email}"
}

# Cloud Function for signed URL generation
resource "google_cloudfunctions_function" "signed_url_generator" {
  name        = "generate-signed-urls"
  runtime     = "python39"
  entry_point = "generate_signed_url"
  
  source_archive_bucket = google_storage_bucket.functions_source.name
  source_archive_object = google_storage_bucket_object.signed_url_function.name
  
  https_trigger {
    url = "https://${var.region}-${var.project_id}.cloudfunctions.net/generate-signed-url"
  }
  
  service_account_email = google_service_account.signed_url_generator.email
  
  environment_variables = {
    BUCKET_NAME = google_storage_bucket.protected_content.name
    URL_EXPIRY_HOURS = "24"
    ALLOWED_IPS = var.allowed_ip_ranges
  }
}