Private link and private endpoint

# Naming conventions
module "naming" {
  source = "Azure/naming/azurerm"
  suffix = ["devl"]
}

# Resource group
resource "azurerm_resource_group" "this" {
  location = var.resource_group_location
  name     = module.naming.resource_group.name
}

# Virtual Network for Windows VM
resource "azurerm_virtual_network" "this" {
  name                = module.naming.virtual_network.name
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
}

# Subnet for VM as well as private endpoint
resource "azurerm_subnet" "this" {
  name                 = "windows-vms-${module.naming.subnet.name}"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = ["10.0.0.0/24"]
}

# Create public IP for windows virtual machine
resource "azurerm_public_ip" "this" {
  name                = "windows-vm-${module.naming.public_ip.name}"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

# Create Network Security Group and rule for RDP access
resource "azurerm_network_security_group" "this" {
  name                = "windows-vm-${module.naming.network_security_group.name}"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  security_rule {
    name                       = "RDP"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "3389"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

# Create network interface and associate it with network security group
resource "azurerm_network_interface" "this" {
  name                = "windows-vm-${module.naming.network_interface.name}"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  ip_configuration {
    name                          = "windows-vm-nic-configuration"
    subnet_id                     = azurerm_subnet.this.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.this.id
  }
}

resource "azurerm_network_interface_security_group_association" "this" {
  network_interface_id      = azurerm_network_interface.this.id
  network_security_group_id = azurerm_network_security_group.this.id
}

# Create windows virtual machine
resource "azurerm_windows_virtual_machine" "this" {
  name                            = "windows-${module.naming.virtual_machine.name}"
  admin_username                  = var.vm_username
  admin_password                  = var.vm_password 
  location                        = azurerm_resource_group.this.location
  resource_group_name             = azurerm_resource_group.this.name
  network_interface_ids           = [azurerm_network_interface.this.id]
  size                            = var.vm_size

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = var.vm_image_publisher
    offer     = var.vm_image_offer
    sku       = var.vm_image_sku
    version   = var.vm_image_version
  }
}

# Get the currently authenticated Azure AD user
data "azuread_client_config" "current" {}

data "azuread_user" "this" {
  object_id = data.azuread_client_config.current.object_id
}

# Create SQL server
resource "azurerm_mssql_server" "this" {
  name                         = "test-${module.naming.sql_server.name}"
  resource_group_name          = azurerm_resource_group.this.name
  location                     = azurerm_resource_group.this.location
  public_network_access_enabled = false

  azuread_administrator {
    login_username = data.azuread_user.this.user_principal_name 
    object_id = data.azuread_user.this.object_id
    azuread_authentication_only = true
  }
  version                      = "12.0"
}

# Create SQL database
resource "azurerm_mssql_database" "this" {
  name      = "test-${module.naming.mssql_database.name}"
  server_id = azurerm_mssql_server.this.id
  sku_name = "Basic"
  storage_account_type = "Local"
}

# Create private endpoint for SQL server
resource "azurerm_private_endpoint" "this" {
  name                = "sql-${module.naming.private_endpoint.name}"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  subnet_id           = azurerm_subnet.this.id

  private_service_connection {
    name                           = "sql-private-serviceconnection"
    private_connection_resource_id = azurerm_mssql_server.this.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "sql-dns-zone-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.this.id]
  }
}

# Create private DNS zone
resource "azurerm_private_dns_zone" "this" {
  #name                =  module.naming.private_dns_zone.name
  name                = "privatelink.database.windows.net"
  resource_group_name = azurerm_resource_group.this.name
}

# Create virtual network link to the private DNS zone
resource "azurerm_private_dns_zone_virtual_network_link" "my_terraform_vnet_link" {
  name                  = "vnet-link"
  resource_group_name   = azurerm_resource_group.this.name
  private_dns_zone_name = azurerm_private_dns_zone.this.name
  virtual_network_id    = azurerm_virtual_network.this.id
}