main.tf

# ---------------------------------------------------------------------------
# Keystone: the load balancer
# ---------------------------------------------------------------------------

resource "azurerm_lb" "this" {
  name                = var.name
  resource_group_name = var.resource_group_name
  location            = var.location
  sku                 = var.sku
  sku_tier            = var.sku_tier
  edge_zone           = var.edge_zone

  dynamic "frontend_ip_configuration" {
    for_each = var.frontend_ip_configurations
    content {
      name                          = frontend_ip_configuration.value.name
      subnet_id                     = try(frontend_ip_configuration.value.subnet_id, null)
      private_ip_address            = try(frontend_ip_configuration.value.private_ip_address, null)
      private_ip_address_allocation = try(frontend_ip_configuration.value.private_ip_address_allocation, null)
      private_ip_address_version    = try(frontend_ip_configuration.value.private_ip_address_version, null)
      public_ip_address_id          = try(frontend_ip_configuration.value.public_ip_address_id, null)
      public_ip_prefix_id           = try(frontend_ip_configuration.value.public_ip_prefix_id, null)

      gateway_load_balancer_frontend_ip_configuration_id = try(frontend_ip_configuration.value.gateway_load_balancer_frontend_ip_configuration_id, null)
      zones                                              = try(frontend_ip_configuration.value.zones, null)
    }
  }

  tags = var.tags

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Backend address pools
# ---------------------------------------------------------------------------

resource "azurerm_lb_backend_address_pool" "this" {
  for_each = var.backend_pools

  loadbalancer_id    = azurerm_lb.this.id
  name               = each.value.name
  synchronous_mode   = try(each.value.synchronous_mode, null)
  virtual_network_id = try(each.value.virtual_network_id, null)

  dynamic "tunnel_interface" {
    for_each = try(each.value.tunnel_interfaces, {})
    content {
      identifier = tunnel_interface.value.identifier
      port       = tunnel_interface.value.port
      protocol   = tunnel_interface.value.protocol
      type       = tunnel_interface.value.type
    }
  }

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Health probes
# ---------------------------------------------------------------------------

resource "azurerm_lb_probe" "this" {
  for_each = var.probes

  loadbalancer_id     = azurerm_lb.this.id
  name                = each.value.name
  port                = each.value.port
  protocol            = try(each.value.protocol, null)
  request_path        = try(each.value.request_path, null)
  interval_in_seconds = try(each.value.interval_in_seconds, null)
  number_of_probes    = try(each.value.number_of_probes, null)
  probe_threshold     = try(each.value.probe_threshold, null)

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Load balancing rules
# ---------------------------------------------------------------------------

resource "azurerm_lb_rule" "this" {
  for_each = var.rules

  loadbalancer_id                = azurerm_lb.this.id
  name                           = each.value.name
  frontend_ip_configuration_name = each.value.frontend_ip_configuration_name
  protocol                       = each.value.protocol
  frontend_port                  = each.value.frontend_port
  backend_port                   = each.value.backend_port

  backend_address_pool_ids = [for k in try(each.value.backend_pool_keys, []) : azurerm_lb_backend_address_pool.this[k].id]
  probe_id                 = try(each.value.probe_key, null) != null ? azurerm_lb_probe.this[each.value.probe_key].id : null

  disable_outbound_snat   = try(each.value.disable_outbound_snat, null)
  floating_ip_enabled     = try(each.value.floating_ip_enabled, null)
  tcp_reset_enabled       = try(each.value.tcp_reset_enabled, null)
  idle_timeout_in_minutes = try(each.value.idle_timeout_in_minutes, null)
  load_distribution       = try(each.value.load_distribution, null)

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Inbound NAT rules
# ---------------------------------------------------------------------------

resource "azurerm_lb_nat_rule" "this" {
  for_each = var.nat_rules

  loadbalancer_id                = azurerm_lb.this.id
  resource_group_name            = var.resource_group_name
  name                           = each.value.name
  frontend_ip_configuration_name = each.value.frontend_ip_configuration_name
  protocol                       = each.value.protocol
  backend_port                   = each.value.backend_port

  frontend_port       = try(each.value.frontend_port, null)
  frontend_port_start = try(each.value.frontend_port_start, null)
  frontend_port_end   = try(each.value.frontend_port_end, null)

  backend_address_pool_id = try(each.value.backend_pool_key, null) != null ? azurerm_lb_backend_address_pool.this[each.value.backend_pool_key].id : null

  floating_ip_enabled     = try(each.value.floating_ip_enabled, null)
  tcp_reset_enabled       = try(each.value.tcp_reset_enabled, null)
  idle_timeout_in_minutes = try(each.value.idle_timeout_in_minutes, null)

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Inbound NAT pools
# ---------------------------------------------------------------------------

resource "azurerm_lb_nat_pool" "this" {
  for_each = var.nat_pools

  loadbalancer_id                = azurerm_lb.this.id
  resource_group_name            = var.resource_group_name
  name                           = each.value.name
  frontend_ip_configuration_name = each.value.frontend_ip_configuration_name
  protocol                       = each.value.protocol
  frontend_port_start            = each.value.frontend_port_start
  frontend_port_end              = each.value.frontend_port_end
  backend_port                   = each.value.backend_port

  floating_ip_enabled     = try(each.value.floating_ip_enabled, null)
  tcp_reset_enabled       = try(each.value.tcp_reset_enabled, null)
  idle_timeout_in_minutes = try(each.value.idle_timeout_in_minutes, null)

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Outbound rules (explicit egress — preferred over implicit SNAT)
# ---------------------------------------------------------------------------

resource "azurerm_lb_outbound_rule" "this" {
  for_each = var.outbound_rules

  loadbalancer_id         = azurerm_lb.this.id
  name                    = each.value.name
  backend_address_pool_id = azurerm_lb_backend_address_pool.this[each.value.backend_pool_key].id
  protocol                = each.value.protocol

  allocated_outbound_ports = try(each.value.allocated_outbound_ports, null)
  idle_timeout_in_minutes  = try(each.value.idle_timeout_in_minutes, null)
  tcp_reset_enabled        = try(each.value.tcp_reset_enabled, null)

  dynamic "frontend_ip_configuration" {
    for_each = each.value.frontend_names
    content {
      name = frontend_ip_configuration.value
    }
  }

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}

# ---------------------------------------------------------------------------
# Backend pool addresses (explicit backend targets)
# ---------------------------------------------------------------------------

resource "azurerm_lb_backend_address_pool_address" "this" {
  for_each = var.backend_pool_addresses

  name                    = each.value.name
  backend_address_pool_id = azurerm_lb_backend_address_pool.this[each.value.backend_pool_key].id

  virtual_network_id                  = try(each.value.virtual_network_id, null)
  ip_address                          = try(each.value.ip_address, null)
  backend_address_ip_configuration_id = try(each.value.backend_address_ip_configuration_id, null)

  dynamic "timeouts" {
    for_each = var.timeouts != null ? [var.timeouts] : []
    content {
      create = try(timeouts.value.create, null)
      read   = try(timeouts.value.read, null)
      update = try(timeouts.value.update, null)
      delete = try(timeouts.value.delete, null)
    }
  }
}