# ── Serverless NEGs — Accounts ────────────────────────────────────────────────

resource "google_compute_region_network_endpoint_group" "accounts_us" {
  name                  = "accounts-neg-us"
  network_endpoint_type = "SERVERLESS"
  region                = "us-central1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.accounts_us.name }
}

resource "google_compute_region_network_endpoint_group" "accounts_eu" {
  name                  = "accounts-neg-eu"
  network_endpoint_type = "SERVERLESS"
  region                = "europe-west1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.accounts_eu.name }
}

resource "google_compute_region_network_endpoint_group" "accounts_apac" {
  name                  = "accounts-neg-apac"
  network_endpoint_type = "SERVERLESS"
  region                = "asia-northeast1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.accounts_apac.name }
}

# ── Serverless NEGs — API ─────────────────────────────────────────────────────

resource "google_compute_region_network_endpoint_group" "api_us" {
  name                  = "api-neg-us"
  network_endpoint_type = "SERVERLESS"
  region                = "us-central1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.api_us.name }
}

resource "google_compute_region_network_endpoint_group" "api_eu" {
  name                  = "api-neg-eu"
  network_endpoint_type = "SERVERLESS"
  region                = "europe-west1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.api_eu.name }
}

resource "google_compute_region_network_endpoint_group" "api_apac" {
  name                  = "api-neg-apac"
  network_endpoint_type = "SERVERLESS"
  region                = "asia-northeast1"
  project               = var.project_id
  cloud_run { service = google_cloud_run_v2_service.api_apac.name }
}

# ── Backend Service — Accounts ────────────────────────────────────────────────

resource "google_compute_backend_service" "accounts" {
  name                  = "accounts-backend-prod"
  project               = var.project_id
  load_balancing_scheme = "EXTERNAL_MANAGED"
  protocol              = "HTTPS"
  # timeout_sec not supported for serverless NEG backends
  security_policy = google_compute_security_policy.marketing.self_link

  # No CDN for accounts — responses are user-specific and must not be cached
  enable_cdn = false

  backend { group = google_compute_region_network_endpoint_group.accounts_us.self_link }
  backend { group = google_compute_region_network_endpoint_group.accounts_eu.self_link }
  backend { group = google_compute_region_network_endpoint_group.accounts_apac.self_link }

  log_config {
    enable      = true
    sample_rate = 1.0
  }
}

# ── Backend Service — API ─────────────────────────────────────────────────────

resource "google_compute_backend_service" "api" {
  name                  = "api-backend-prod"
  project               = var.project_id
  load_balancing_scheme = "EXTERNAL_MANAGED"
  protocol              = "HTTPS"
  # timeout_sec not supported for serverless NEG backends
  security_policy = google_compute_security_policy.marketing.self_link

  enable_cdn = false  # API responses are per-request; no CDN benefit

  backend { group = google_compute_region_network_endpoint_group.api_us.self_link }
  backend { group = google_compute_region_network_endpoint_group.api_eu.self_link }
  backend { group = google_compute_region_network_endpoint_group.api_apac.self_link }

  log_config {
    enable      = true
    sample_rate = 1.0
  }
}

# ── SSL Certs — accounts and api subdomains ───────────────────────────────────
# Added to the existing prod HTTPS proxy alongside the marketing cert.
# DNS must point to the same prod global IP (marketing-ip-prod) for
# provisioning to succeed.

resource "google_compute_managed_ssl_certificate" "accounts" {
  name    = "accounts-cert-prod"
  project = var.project_id
  managed {
    domains = ["accounts.neurontechnologies.ai"]
  }
}

resource "google_compute_managed_ssl_certificate" "api" {
  name    = "api-cert-prod"
  project = var.project_id
  managed {
    domains = ["api.neurontechnologies.ai"]
  }
}