resource "aws_security_group" "app" {
  name        = "tinycommerce-app-sg"
  description = "Allow app and SSH traffic"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["180.191.0.0/16"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "app" {
  ami             = "ami-0abcdef1234567890"
  instance_type   = "t3.small"
  security_groups = [aws_security_group.app.name]

  tags = {
    Name = "tinycommerce-app-01"
  }

  lifecycle {
    prevent_destroy = true
  }
}