# Certificate Manager with multiple domains
resource "google_certificate_manager_certificate" "multi_domain_cert" {
  name        = "multi-domain-certificate"
  description = "Certificate for multiple domains"
  scope       = "DEFAULT"

  managed {
    domains = [
      "example.com",
      "www.example.com",
      "api.example.com",
      "admin.example.com"
    ]
    dns_authorizations = [
      google_certificate_manager_dns_authorization.main.id,
      google_certificate_manager_dns_authorization.www.id,
      google_certificate_manager_dns_authorization.api.id,
      google_certificate_manager_dns_authorization.admin.id
    ]
  }
}

# DNS authorizations for domain verification
resource "google_certificate_manager_dns_authorization" "main" {
  name   = "main-dns-auth"
  domain = "example.com"
}

resource "google_certificate_manager_dns_authorization" "www" {
  name   = "www-dns-auth"
  domain = "www.example.com"
}

resource "google_certificate_manager_dns_authorization" "api" {
  name   = "api-dns-auth"
  domain = "api.example.com"
}

resource "google_certificate_manager_dns_authorization" "admin" {
  name   = "admin-dns-auth"
  domain = "admin.example.com"
}

# Certificate Map for domain-specific routing
resource "google_certificate_manager_certificate_map" "domain_map" {
  name        = "certificate-map"
  description = "Certificate mapping for multiple domains"
}

resource "google_certificate_manager_certificate_map_entry" "main_entry" {
  name         = "main-cert-entry"
  map          = google_certificate_manager_certificate_map.domain_map.name
  certificates = [google_certificate_manager_certificate.multi_domain_cert.id]
  hostname     = "example.com"
}

resource "google_certificate_manager_certificate_map_entry" "api_entry" {
  name         = "api-cert-entry"
  map          = google_certificate_manager_certificate_map.domain_map.name
  certificates = [google_certificate_manager_certificate.multi_domain_cert.id]
  hostname     = "api.example.com"
}

resource "google_compute_managed_ssl_certificate" "default" {
  name = "managed-ssl-cert"
  
  managed {
    domains = [
      "example.com",
      "www.example.com",
      "api.example.com"
    ]
  }
}

# External IP address
resource "google_compute_address" "network_lb_ip" {
  name = "network-lb-external-ip"
}

# Health check for TCP service
resource "google_compute_health_check" "tcp_health_check" {
  name               = "tcp-health-check"
  check_interval_sec = 5
  timeout_sec        = 3
  healthy_threshold  = 2
  unhealthy_threshold = 3

  tcp_health_check {
    port = "8080"
  }
}

# Backend service
resource "google_compute_region_backend_service" "network_backend" {
  name                  = "network-backend-service"
  protocol              = "TCP"
  load_balancing_scheme = "EXTERNAL"
  health_checks         = [google_compute_health_check.tcp_health_check.id]

  backend {
    group = google_compute_instance_group.backend_group.id
  }
}

# Forwarding rule
resource "google_compute_forwarding_rule" "network_lb_rule" {
  name                  = "network-lb-forwarding-rule"
  ip_address            = google_compute_address.network_lb_ip.address
  port_range            = "8080"
  backend_service       = google_compute_region_backend_service.network_backend.id
  load_balancing_scheme = "EXTERNAL"
}

# Internal TCP/UDP Load Balancer
resource "google_compute_forwarding_rule" "internal_lb" {
  name                  = "internal-tcp-lb"
  load_balancing_scheme = "INTERNAL"
  backend_service       = google_compute_region_backend_service.internal_backend.id
  all_ports             = true
  allow_global_access   = true
  network               = "default"
  subnetwork            = "default"
}

resource "google_compute_region_backend_service" "internal_backend" {
  name                  = "internal-backend-service"
  protocol              = "TCP"
  load_balancing_scheme = "INTERNAL"
  health_checks         = [google_compute_health_check.internal_health.id]

  backend {
    group = google_compute_instance_group.internal_group.id
  }
}

# Backend service with optimized CDN configuration
resource "google_compute_backend_service" "cdn_optimized_backend" {
  name        = "cdn-optimized-backend"
  protocol    = "HTTP"
  timeout_sec = 10

  backend {
    group = google_compute_instance_group.web_servers.id
  }

  health_checks = [google_compute_http_health_check.default.id]

  # Enable Cloud CDN with advanced configuration
  enable_cdn = true

  cdn_policy {
    cache_mode                   = "CACHE_ALL_STATIC"
    default_ttl                 = 3600
    max_ttl                     = 86400
    client_ttl                  = 1800
    negative_caching            = true
    
    negative_caching_policy {
      code = 404
      ttl  = 120
    }
    
    negative_caching_policy {
      code = 500
      ttl  = 60
    }
    
    # Advanced cache key configuration
    cache_key_policy {
      include_host         = true
      include_protocol     = true
      include_query_string = false
      query_string_whitelist = ["version", "locale", "format"]
      include_http_headers = ["Accept-Language"]
    }
    
    # Signed URL configuration for protected content
    signed_url_cache_max_age_sec = 3600
  }
}

# Cloud Armor security policy
resource "google_compute_security_policy" "security_policy" {
  name = "load-balancer-security-policy"

  # DDoS protection rule
  rule {
    action   = "allow"
    priority = "1000"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow rule"
    
    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
      
      rate_limit_threshold {
        count        = 100
        interval_sec = 60
      }
    }
  }

  # Block specific countries
  rule {
    action   = "deny(403)"
    priority = "2000"
    match {
      expr {
        expression = "origin.region_code == 'CN' || origin.region_code == 'RU'"
      }
    }
    description = "Block traffic from specific regions"
  }

  # SQL injection protection
  rule {
    action   = "deny(403)"
    priority = "3000"
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('sqli-stable')"
      }
    }
    description = "Block SQL injection attempts"
  }

  # XSS protection
  rule {
    action   = "deny(403)"
    priority = "4000"
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('xss-stable')"
      }
    }
    description = "Block XSS attempts"
  }
}

# Apply security policy to backend service
resource "google_compute_backend_service" "secure_backend" {
  name        = "secure-backend-service"
  protocol    = "HTTP"
  timeout_sec = 10

  security_policy = google_compute_security_policy.security_policy.id

  backend {
    group = google_compute_instance_group.web_servers.id
  }

  health_checks = [google_compute_http_health_check.default.id]
}

# Enhanced backend configuration for performance
resource "google_compute_backend_service" "optimized_backend" {
  name        = "optimized-backend-service"
  protocol    = "HTTP"
  timeout_sec = 30

  backend {
    group = google_compute_instance_group.web_servers.id
    
    # Connection balancing mode
    balancing_mode  = "UTILIZATION"
    max_utilization = 0.8
    
    # Connection draining
    capacity_scaler = 1.0
  }

  health_checks = [google_compute_health_check.optimized_health.id]

  # Connection draining
  connection_draining_timeout_sec = 300

  # Session affinity for stateful applications
  session_affinity = "CLIENT_IP"

  # Load balancing algorithm
  locality_lb_policy = "ROUND_ROBIN"

  # Circuit breaker configuration
  circuit_breakers {
    max_requests_per_connection = 10
    max_connections            = 100
    max_pending_requests       = 10
    max_requests               = 100
    max_retries               = 3
  }
}

# Multi-region backend service configuration
resource "google_compute_backend_service" "global_backend" {
  name        = "global-multi-region-backend"
  protocol    = "HTTP"
  timeout_sec = 30
  
  # US region backend
  backend {
    group = google_compute_instance_group.us_central1.id
    balancing_mode = "RATE"
    max_rate = 1000
    capacity_scaler = 1.0
  }
  
  # Europe region backend
  backend {
    group = google_compute_instance_group.europe_west1.id
    balancing_mode = "RATE"
    max_rate = 1000
    capacity_scaler = 1.0
  }
  
  # Asia region backend
  backend {
    group = google_compute_instance_group.asia_southeast1.id
    balancing_mode = "RATE"
    max_rate = 1000
    capacity_scaler = 1.0
  }

  health_checks = [google_compute_health_check.global_health.id]
  
  # Locality preferences for optimal routing
  locality_lb_policy = "MAGLEV"
  
  # Consistent hash for session affinity across regions
  consistent_hash {
    minimum_ring_size = 1024
  }
}

# Blue-Green deployment configuration
resource "google_compute_url_map" "blue_green_url_map" {
  name            = "blue-green-url-map"
  default_service = google_compute_backend_service.blue_backend.id

  host_rule {
    hosts        = ["app.example.com"]
    path_matcher = "blue-green-matcher"
  }

  path_matcher {
    name            = "blue-green-matcher"
    default_service = var.active_environment == "blue" ? google_compute_backend_service.blue_backend.id : google_compute_backend_service.green_backend.id

    # Canary testing route
    path_rule {
      paths   = ["/canary/*"]
      service = google_compute_backend_service.green_backend.id
    }
  }
}

# Blue environment backend
resource "google_compute_backend_service" "blue_backend" {
  name     = "blue-backend-service"
  protocol = "HTTP"
  
  backend {
    group = google_compute_instance_group.blue_environment.id
  }
  
  health_checks = [google_compute_health_check.app_health.id]
}

# Green environment backend
resource "google_compute_backend_service" "green_backend" {
  name     = "green-backend-service"
  protocol = "HTTP"
  
  backend {
    group = google_compute_instance_group.green_environment.id
  }
  
  health_checks = [google_compute_health_check.app_health.id]
}

# Cloud Run integration with HTTP(S) Load Balancer
resource "google_cloud_run_service" "api_service" {
  name     = "api-service"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/project/api:latest"
        
        resources {
          limits = {
            cpu    = "2"
            memory = "2Gi"
          }
        }
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

# Network Endpoint Group for Cloud Run
resource "google_compute_region_network_endpoint_group" "cloud_run_neg" {
  name                  = "cloud-run-neg"
  network_endpoint_type = "SERVERLESS"
  region                = "us-central1"
  
  cloud_run {
    service = google_cloud_run_service.api_service.name
  }
}

# Backend service for serverless
resource "google_compute_backend_service" "serverless_backend" {
  name = "serverless-backend-service"
  
  backend {
    group = google_compute_region_network_endpoint_group.cloud_run_neg.id
  }
  
  # Serverless-optimized configuration
  timeout_sec = 300
  protocol    = "HTTP"
}