「模块化设计模式」

无模块：
  dev/main.tf ── VPC + 子网 + 安全组 + IAM（手写）
  prod/main.tf ── VPC + 子网 + 安全组 + IAM（复制）
  staging/main.tf ── ...（再复制）

有模块：
  modules/network ── VPC + 子网（一份，参数化）
  dev/main.tf ── module "network" { source = "../modules/network" }
  prod/main.tf ── module "network" { source = "...", env = "prod" }

variable "environment" {
  type        = string
  default     = "dev"
  description = "部署环境，可选 dev/staging/prod"
}

variable "instance_type" {
  type = string
}

variable "subnet_cidrs" {
  type = list(string)
}

variable "tags" {
  type    = map(string)
  default = {}
}

variable "ingress_rules" {
  type = list(object({
    port     = number
    protocol = string
    cidr     = string
  }))
}

variable "bucket_force_destroy" {
  type    = bool
  default = false
}

variable "optional_value" {
  type    = string
  default = null    # 允许不传，后续用 coalesce 兜底
}

variable "must_provide" {
  type = string      # 无 default → 调用方必须传
}

variable "environment" {
  type = string

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment 必须是 dev/staging/prod 之一"
  }
}

variable "cidr" {
  type = string

  validation {
    condition     = can(cidrhost(var.cidr, 0))
    error_message = "cidr 必须是合法的 CIDR 网段"
  }
}

output "vpc_id" {
  value = aws_vpc.main.id
}

output "subnet_ids" {
  value = aws_subnet.main[*].id
}

output "security_group_id" {
  value = aws_security_group.web.id
}

output "database_password" {
  value     = aws_db_instance.db.password
  sensitive = true   # apply 后不回显明文
}

module "network" {
  source = "../modules/network"
}

resource "aws_instance" "web" {
  subnet_id        = module.network.subnet_ids[0]
  security_groups  = [module.network.security_group_id]
}

locals {
  name_prefix = "${var.environment}-${var.project}"

  # 计算出的标签
  all_tags = merge(
    { project = var.project, env = var.environment },
    var.tags,
  )

  # 由环境推导实例规格
  instance_type = var.environment == "prod" ? "t3.large" : "t3.micro"

  # 网段分段
  subnet_cidrs = [
    for idx, cidr in var.vpc_cidr : cidrsubnet(cidr, 8, idx)
  ]
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"                # 精确锁定
}

module "s3" {
  source  = "registry.terraform.io/terraform-aws-modules/s3-bucket/aws"
  version = ">= 4.0.0, < 5.0.0"    # 范围约束
}

# 锁定模块版本到 lockfile
terraform init -upgrade
# .terraform.lock.hcl 记录已解析的确切版本与校验和

# 上层「应用模块」组合底层「网络模块」「计算模块」
module "network" {
  source = "../modules/network"
  cidr   = var.cidr
}

module "compute" {
  source         = "../modules/compute"
  vpc_id         = module.network.vpc_id
  instance_type  = var.instance_type
  subnet_cidrs   = module.network.subnet_ids
}

# 面向调用方暴露业务语义，隐藏云厂商差异
module "web_tier" {
  source = "./modules/web_tier"
  region = var.region
  # 调用方不感知内部用了 ALB 还是 NLB
}

output "web_endpoint" {
  value = module.web_tier.endpoint
}

# ❌ 反模式：一个模块塞几十个变量，谁都能传，没人知道怎么用
variable "settings" {
  type = map(any)   # any 让校验形同虚设
}

# ✅ 改进：细分对象类型
variable "settings" {
  type = object({
    replica_count = number
    enable_backup = bool
    retention     = number
  })
  default = { replica_count = 1, enable_backup = true, retention = 7 }
}

# Terraform 1.6+ 模块测试文件 tests/basic.tftest.hcl
run "basic" {
  command = plan
  variables { environment = "dev" }

  assert {
    condition     = aws_vpc.main.cidr_block == "10.0.0.0/16"
    error_message = "VPC CIDR 不正确"
  }
}

# 校验整个模块目录
terraform validate
terraform fmt -recursive
terraform test