10.10-bob: Infrastructure as Code — Terraform asoslari

  INFRASTRUCTURE AS CODE (IaC) — infratuzilmani QO'LDA emas, KOD bilan boshqarish:
   server, tarmoq, DB, IP — hammasi matnli faylda ta'riflanadi (versiyalanadi)

  3 XIL YONDASHUV (infratuzilma qanday yaratiladi):

  1. ClickOps (QO'LDA) — AWS Console'da sichqoncha bilan 10.6-bob:
      takrorlab bo'lmaydi (har safar boshqacha)
      hujjatsiz ("qanday sozlagandim?" — eslab bo'lmaydi)
      xato ko'p (inson qo'li), audit yo'q

  2. IMPERATIVE (qadamlar bilan) — skript yoziladi (bash, AWS CLI — 10.6):
     "avval EC2 yarat, keyin SG yarat, keyin biriktir..." (HOW — qanday)
      holat o'zgarsa — skript buziladi (allaqachon bor bo'lsa xato beradi)

  3. DECLARATIVE (kerakli holat) — Terraform:
     "menga 1 EC2 + 1 S3 + 1 SG KERAK" (WHAT — nima, tartibni o'zi hal qiladi)
      Terraform real holatni tekshirib, FARQNI hisoblaydi (yo'qni yaratadi)
      ikki marta ishlatsang ham — natija bir xil (idempotent)

  TERRAFORM — IaC vositasi (HashiCorp), infratuzilmani kod bilan quradi:
  "Terraform lets you build, change, and version cloud and on-prem resources
   safely and efficiently" (rasmiy ta'rif)

  ASOSIY XUSUSIYATLAR:
   DECLARATIVE — kerakli holatni ta'riflaysan 2.1-bob, Terraform amalga oshiradi
   MULTI-CLOUD — bitta til (HCL) bilan AWS, GCP, Azure, K8s, GitHub... 2.3-bob
   STATE-BASED — real holatni state faylda kuzatadi 2.7-bob
   PLAN — o'zgarishni OLDINDAN ko'rsatadi (xavfsizlik — 2.6, 2.8)

  TERRAFORM QANDAY ISHLAYDI (yuqori daraja):
  ┌──────────────┐   o'qiydi   ┌─────────────┐   API    ┌──────────────┐
  │  .tf fayllar │ ────────── │  TERRAFORM  │ ─────── │  AWS / GCP   │
  │  (HCL kod)   │             │  (engine +  │          │  (haqiqiy    │
  │  kerakli     │             │  provider)  │ ─────── │   resurslar) │
  │  holat       │             └──────┬──────┘  holat   └──────────────┘
  └──────────────┘                    │
                              ┌────────▼────────┐
                              │ terraform.tfstate│   real holat xaritasi
                              └─────────────────┘

  HCL (HashiCorp Configuration Language) — Terraform'ning tili:
   matnli, o'qilishi oson, ikki asosiy qurilma: ARGUMENT va BLOCK

  ARGUMENT — nomga qiymat beradi (ism = qiymat):
  ┌─────────────────────────────────┐
  │  instance_type = "t3.micro"     │
  │  └────┬─────┘  │  └────┬─────┘   │
  │     IDENTIFIER =     QIYMAT       │
  │     (nom)        (expression)     │
  └─────────────────────────────────┘

  BLOCK — boshqa mazmun saqlovchi konteyner (TUR + LABEL'lar + tana {}):
  ┌──────────────────────────────────────────────┐
  │  resource  "aws_instance"  "web"  {           │
  │  └───┬───┘ └──────┬──────┘ └─┬─┘  │           │
  │    TUR        1-LABEL     2-LABEL  tana        │
  │  (block type) (resurs turi)(nom)               │
  │                                                │
  │    ami           = "ami-0abc123"   argument   │
  │    instance_type = "t3.micro"      argument   │
  │  }                                             │
  └──────────────────────────────────────────────┘

  IZOH:   # bir qatorli (asosiy)   // ham mumkin   /* ko'p qatorli */
   Fayl UTF-8, kengaytma .tf ; identifier harf/_ bilan boshlanadi

  PROVIDER — Terraform'ni biror platformaga ulaydigan PLAGIN:
   har resurs turi bitta provider tomonidan amalga oshiriladi
   providersiz Terraform HECH NARSA boshqara olmaydi (rasmiy)

  MASHHUR PROVIDER'LAR (Terraform Registry'da minglab bor):
  - hashicorp/aws     AWS (EC2, S3, RDS — 10.6)
  - hashicorp/google  Google Cloud (GCP)
  - hashicorp/azurerm Microsoft Azure
  - hashicorp/kubernetes  K8s 10.8-bob ;  cloudflare, github, docker...

  E'LON QILISH (har modul qaysi provider kerakligini AYTADI):
  terraform {
    required_providers {
      aws = {
        source  = "hashicorp/aws"   # Registry'dagi manba
        version = "~> 5.0"          # versiya cheklovi (2.12 — muhim!)
      }
    }
  }

  provider "aws" {                  # provider'ni sozlash
    region = "eu-central-1"         # qaysi region (10.6: 2.2)
  }

  RESOURCE — Terraform YARATADIGAN/boshqaradigan obyekt (eng muhim element):
   "Resources are the most important element in the Terraform language" (rasmiy)
   bitta resource bloki = bitta (yoki ko'p) infratuzilma obyekti

  resource "aws_instance" "web" {     # YARATILADI (Terraform boshqaradi)
    ami           = "ami-0abc123"
    instance_type = "t3.micro"
  }
   ichki murojaat: aws_instance.web.id  (boshqa joyda shu resursga havola)

  DATA SOURCE — MAVJUD resursni faqat O'QIYDI (yaratmaydi):
   Terraform tashqarida yaratilgan narsani "ko'radi" (faqat o'qish)

  data "aws_ami" "ubuntu" {           # MAVJUD AMI'ni IZLAYDI (yaratmaydi)
    most_recent = true
    owners      = ["099720109477"]    # Canonical (Ubuntu)
    filter { name = "name"  values = ["ubuntu/images/*-24.04-*"] }
  }
   ishlatish: ami = data.aws_ami.ubuntu.id  (topilgan AMI'ni resource'ga ber)

   resource = MEN yarataman/boshqaraman ; data = MAVJUD narsani o'qiyman

  TERRAFORM ASOSIY ISH JARAYONI (4 buyruq — eng muhim):

  1. terraform init     TAYYORLASH (har loyihada birinchi marta):
      provider'larni yuklab oladi 2.4-bob, backend'ni sozlaydi 2.10-bob
      .terraform/ papka + .terraform.lock.hcl yaratiladi

  2. terraform plan     OLDINDAN KO'RISH (nima o'zgaradi — XAVFSIZLIK):
      real holat (state) bilan kerakli holatni solishtiradi
      + create (yashil)   ~ update   - destroy (qizil)  ko'rsatadi
      HECH NARSA o'zgartirmaydi (faqat reja — quruq yugurish)

  3. terraform apply    QO'LLASH (haqiqatan yaratadi/o'zgartiradi):
      plan'ni ko'rsatadi  "yes" deb tasdiqlaysan  bajaradi
      state faylni yangilaydi (real holat yoziladi)

  4. terraform destroy  O'CHIRISH (boshqarilgan hamma resursni o'chiradi):
      faqat Terraform yaratganini o'chiradi (ehtiyot — qaytmaydi!)

  YORDAMCHI: terraform fmt (formatla) | validate (tekshir) | show (holatni ko'r)

  STATE — Terraform boshqargan REAL holatning XARITASI:
   default: terraform.tfstate (JSON fayl, lokal)
   "source of truth" — qaysi kod qaysi haqiqiy resursga mos kelishi

  NEGA KERAK (Terraform'siz bilolmaydi):
  - kod: aws_instance.web      haqiqat: i-0abc123 (qaysi EC2 — state'da yozilgan)
  - state bo'lmasa — Terraform "men nimani yaratganman?" deb bilolmaydi
  - plan tezligi: state'dagi holatni asos qilib farqni hisoblaydi

  DRIFT — kod bilan haqiqat ORASIDAGI farq (kimdir QO'LDA o'zgartirsa):
  ┌──────────────┐         ┌──────────────┐         ┌──────────────┐
  │  KOD (.tf)   │  =?=    │  STATE       │  =?=    │  HAQIQAT(AWS)│
  │ t3.micro     │         │ t3.micro     │        │ t3.LARGE     │  kimdir
  └──────────────┘         └──────────────┘         └──────────────┘   qo'lda
   terraform plan drift'ni ko'rsatadi (qaytib kodga moslashtiradi — refresh)  o'zgartirgan

   STATE FAYLI — JIDDIY: secret'larni OCHIQ saqlashi mumkin (parol, kalit — 2.11)
   tfstate'ni Git'ga commit QILMA (xavf!) — remote backend ishlat (2.10)

  PLAN — apply'dan OLDIN nima bo'lishini ko'rsatadi (review qilinadi — xavfsizlik):

  $ terraform plan
  Terraform will perform the following actions:

    # aws_instance.web will be created
    + resource "aws_instance" "web" {
        + ami           = "ami-0abc123"           + yangi qiymat
        + instance_type = "t3.micro"
        + id            = (known after apply)     yaratilgach ma'lum bo'ladi
      }
  Plan: 1 to add, 0 to change, 0 to destroy.     XULOSA (eng muhim qator!)

  BELGILAR:  + create   ~ update (joyida)   -/+ replace (o'chir+yarat)   - destroy

  DEPENDENCY GRAPH — Terraform tartibni O'ZI hisoblaydi:
   aws_instance ami = data.aws_ami.ubuntu.id    AVVAL data, KEYIN instance
   bog'liq bo'lmaganlarni PARALLEL yaratadi (tez)

   plan'ni DOIM o'qi: "X to destroy" ko'rsatsa — nima o'chayotganini tekshir!

  VARIABLE — kodga TASHQARIDAN kiritiladigan qiymat (parametrlash):
  variable "instance_type" {
    type        = string
    default     = "t3.micro"        # berilmasa — shu (ixtiyoriy)
    description = "EC2 instance o'lchami"
  }
   ishlatish: instance_type = var.instance_type

  QIYMAT BERISH (bir necha usul, prioritet ortib boradi):
  - default (kodda)  <  terraform.tfvars fayl  <  -var CLI  <  TF_VAR_ env

  OUTPUT — apply'dan KEYIN chiqariladigan qiymat (natija):
  output "public_ip" {
    value = aws_instance.web.public_ip   # yaratilgan IP'ni ko'rsat
  }
   terraform apply oxirida: public_ip = "203.0.113.5"

  SENSITIVE — maxfiy qiymatni yashirish (parol, IP — 2.11):
  output "db_password" {
    value     = aws_db_instance.main.password
    sensitive = true                # plan/output'da "(sensitive)" deb yashiradi
  }

  BACKEND — state QAYERDA saqlanishini belgilaydi:
  - LOCAL (default) — terraform.tfstate lokal faylda (faqat o'zing — yomon jamoa uchun)
  - REMOTE — markaziy joyda (S3, HCP Terraform, GCS, Azure Blob...) — JAMOA uchun

  NEGA REMOTE (jamoada lokal state YOMON):
   lokal: har kimda o'z nusxasi (bir-biriga zid — konflikt)
   lokal: kompyuter buzilsa — state yo'qoladi (resurslar "yetim" qoladi)
   remote: bitta markaziy state (hamma bir manbadan o'qiydi)
   remote: shifrlash + versiyalash + LOCK

  STATE LOCKING — ikki kishi BIR VAQTDA apply qilmasligi uchun qulf:
   A apply qilayotganda — B kutadi (state buzilmaydi — race condition yo'q)

  S3 BACKEND (AWS — eng keng tarqalgan):
  terraform {
    backend "s3" {
      bucket       = "mening-tfstate-2026"    # state saqlanadigan S3 (10.6: 2.6)
      key          = "prod/terraform.tfstate" # bucket ichidagi yo'l
      region       = "eu-central-1"
      encrypt      = true                      # state shifrlanadi (2.7 — secret!)
      use_lockfile = true                      # NATIVE S3 lock (2026 — yangi usul)
    }
  }
   ESKI: DynamoDB jadval bilan lock (endi deprecated — use_lockfile afzal — rasmiy)

  MODULE — birga boshqariladigan resurslar TO'PLAMI (qayta ishlatiladigan paket):
   "A module is a collection of resources that Terraform manages together" (rasmiy)

  ROOT MODULE — sen turgan asosiy papka (terraform shu yerda ishga tushadi)
  CHILD MODULE — root chaqiradigan boshqa modul (module bloki orqali)

  CHAQIRISH (module bloki):
  module "vpc" {
    source  = "terraform-aws-modules/vpc/aws"  # Registry'dan (yoki ./local-yo'l)
    version = "5.0.0"                            # versiya (qulflash — 2.12)
    name    = "mening-vpc"                       # modulga kirish (variable)
    cidr    = "10.0.0.0/16"
  }
   natija: module.vpc.vpc_id  (modul output'iga murojaat)

  MANBA (source) TURLARI:
  - ./modules/network   lokal papka (o'z modullaring)
  - terraform-aws-modules/vpc/aws  Terraform Registry (ommaviy, tayyor)
  - github.com/org/repo  Git repozitoriy

   MODULE = funksiya (5.6'dagi funksiyaga o'xshash): input (var)  resurslar  output

  WORKSPACE — bir kod, ko'p ALOHIDA state (dev/staging/prod):
  terraform workspace new dev      # yangi workspace
  terraform workspace new prod
  terraform workspace select prod  # prod'ga o'tish
   har workspace'da AYRIM state (dev resurslari prod'dan ajralgan)
   ko'pincha katta loyihalarda alohida PAPKA/backend afzal (workspace o'rniga)

  VERSIYA CHEKLOVI (juda muhim — kutilmagan buzilishdan himoya):
  required_version = ">= 1.5"        # Terraform o'zining versiyasi
  version = "~> 5.0"    5.x ruxsat, 6.0 EMAS (pessimistik operator)
  version = ">= 5.0, < 6.0"          # aniq diapazon
   .terraform.lock.hcl provider'ni AYNAN qulflaydi (jamoa bir versiya)

  SENSITIVE / SECRET (10.11 bilan bog'liq):
  - sensitive = true  terminal/log'da yashiradi 2.9-bob
  - LEKIN state'da OCHIQ 2.7-bob  remote+encrypt MAJBURIY 2.10-bob
  - secret'larni kodga YOZMA  tfvars (gitignore) yoki Vault/SSM (10.11)

  IaC VOSITALARI — qachon qaysi biri:

  ┌──────────────┬─────────────┬──────────────────────────────────────┐
  │ Vosita       │ Tur         │ Farqi                                │
  ├──────────────┼─────────────┼──────────────────────────────────────┤
  │ Terraform    │ provisioning│ declarative, multi-cloud, state, HCL │
  │ Ansible      │ config mgmt │ server ICHINI sozlash (paket, fayl)  │
  │              │             │  ko'pincha Terraform BILAN birga    │
  │ CloudFormation│ provisioning│ faqat AWS (HCL emas, YAML/JSON)      │
  │ Pulumi       │ provisioning│ Terraform'ga o'xshash, lekin TS/Py/Go│
  │ OpenTofu     │ provisioning│ Terraform'ning ochiq forki (2023+)   │
  └──────────────┴─────────────┴──────────────────────────────────────┘

  XULOSA:
  - infratuzilma YARATISH (server, tarmoq, DB)  Terraform (provisioning)
  - server ICHINI sozlash (Node o'rnatish, config)  Ansible yoki Docker 10.3-bob
   ko'p loyiha: Terraform (resurs) + Ansible/Docker (sozlash) — birga

  KO'P RESURS YARATISH — bir blok, ko'p nusxa (qo'lda takrorlamaslik — DRY):

  count — SON bo'yicha (0, 1, 2... nusxa):
  resource "aws_instance" "web" {
    count         = 3                      # 3 ta bir xil EC2
    instance_type = "t3.micro"
    tags = { Name = "web-${count.index}" } # count.index: 0,1,2
  }
   murojaat: aws_instance.web[0].id  (indeks bilan — ro'yxat)
   MUAMMO: o'rtadan bittasi o'chsa — indekslar SILJIYDI (keyingilar qayta yaratiladi)

  for_each — TO'PLAM (map/set) bo'yicha — TURG'UN kalit (afzalroq):
  resource "aws_instance" "web" {
    for_each      = toset(["web", "api", "worker"])   # 3 ta NOMLI
    instance_type = "t3.micro"
    tags = { Name = each.key }             # each.key / each.value
  }
   murojaat: aws_instance.web["api"].id  (kalit bilan — o'chsa boshqasi tegmaydi)
   QOIDA: bir xil nusxa + tartib muhim  count ;  nomli/turg'un  for_each (afzal)

  dynamic — takrorlanuvchi ICHKI BLOK generatsiyasi (SG qoidalari kabi):
  dynamic "ingress" {
    for_each = var.ports                   # [80, 443, 8080] uchun
    content {                              # har biriga bitta ingress bloki
      from_port = ingress.value  to_port = ingress.value  protocol = "tcp"
    }
  }

  lifecycle — resurs HAYOT SIKLINI boshqarish (meta-argument):
  lifecycle {
    create_before_destroy = true    # AVVAL yangi yarat, KEYIN eskini o'chir (uzilishsiz)
    prevent_destroy       = true    # bu resursni O'CHIRISHNI bloklaydi (prod DB himoyasi)
    ignore_changes        = [tags]  # bu maydon drift'ini E'TIBORSIZ qoldir (tashqi o'zgarish)
  }

  LOCAL VALUES — kod ichidagi TAKRORLANUVCHI ifodaga nom (var emas — ichki):
  locals {
    project = "mening-loyiham"
    common_tags = { Project = local.project, ManagedBy = "Terraform" }
  }
   ishlatish: tags = local.common_tags   (bir marta yoz, hamma joyda ishlat — DRY)
   variable = TASHQARIDAN kiritiladi ;  local = ICHKARIDA hisoblanadi

  BOG'LIQLIK (dependency) — Terraform tartibni O'ZI biladi:
  - IMPLICIT (yashirin) — havola orqali AVTOMATIK (afzal):
    vpc_security_group_ids = [aws_security_group.web.id]   avval SG, keyin EC2
  - EXPLICIT — depends_on (havola YO'Q, lekin tartib kerak — kamdan-kam):
    resource "aws_instance" "web" {
      depends_on = [aws_s3_bucket.data]   # IAM/yon-effekt bog'liqligi
    }

  PROVISIONER — OXIRGI CHORA (resurs yaratilgach buyruq bajarish):
  provisioner "remote-exec" { inline = ["sudo apt install -y nginx"] }
   RASMIY: provisioner — SO'NGGI chora. Afzal: user_data / Ansible / Docker 2.13-bob

  PROVIDER ALIAS — bir provider'ning bir NECHTA sozlamasi (ko'p region):
  provider "aws" { region = "eu-central-1" }              # asosiy (default)
  provider "aws" { alias = "us"  region = "us-east-1" }   # ikkinchi region
   ishlatish: resource "aws_instance" "x" { provider = aws.us  ... }

  IMPORT — MAVJUD (qo'lda yaratilgan) resursni Terraform boshqaruviga olish:
  terraform import aws_instance.web i-0abc123   # eski usul (CLI)
  import { to = aws_instance.web  id = "i-0abc123" }  # yangi: import bloki (kodda)
   import faqat STATE'ga qo'shadi — resource blokini QO'LDA yozish kerak (plan tekshiradi)

WORKFLOW 2.6-bob: terraform init | plan | apply | destroy | fmt | validate | show
                terraform apply -auto-approve  (tasdiqsiz — CI/CD'da ehtiyot)
BLOCK 2.3-bob:    resource "<TUR>" "<NOM>" { argument = qiymat }
PROVIDER 2.4-bob: terraform { required_providers { aws = { source="hashicorp/aws" } } }
                provider "aws" { region = "eu-central-1" }
RESOURCE 2.5-bob: resource "aws_instance" "web" { ami = "..." instance_type = "..." }
DATA 2.5-bob:     data "aws_ami" "x" {...}    data.aws_ami.x.id
VARIABLE 2.9-bob: variable "name" { type=string default="..." }    var.name
OUTPUT 2.9-bob:   output "ip" { value = aws_instance.web.public_ip }
HAVOLA:         aws_instance.web.id  |  module.vpc.vpc_id  |  data.x.y.z
BACKEND 2.10-bob: terraform { backend "s3" { bucket=".." key=".." use_lockfile=true } }
MODULE 2.11-bob:  module "vpc" { source="./modules/vpc"  cidr="10.0.0.0/16" }
WORKSPACE2.12-bob:terraform workspace new|select|list  dev|prod
STATE 2.7-bob:    terraform state list | show <addr> | rm <addr>  (ehtiyotkorona!)
COUNT 2.14-bob:   resource "..." "x" { count = 3 ... }     ...x[0].id  (count.index)
FOR_EACH2.14-bob: resource "..." "x" { for_each = toset([...]) }    ...x["k"]  (each.key)
DYNAMIC 2.14-bob: dynamic "ingress" { for_each = ... content { ... } }
LIFECYCLE2.14-bob:lifecycle { create_before_destroy | prevent_destroy | ignore_changes }
LOCAL 2.15-bob:   locals { common_tags = {...} }    local.common_tags
DEPENDS 2.15-bob: depends_on = [aws_s3_bucket.data]   (yashirin bog'liqlik)
ALIAS 2.15-bob:   provider "aws" { alias = "us" ... }    provider = aws.us
IMPORT 2.15-bob:  import { to = aws_instance.web  id = "i-0abc123" }

# Terraform o'rnatish (rasmiy — HashiCorp repozitoriysidan, Ubuntu — 10.1)
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor \
  -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
  https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform     # o'rnatish (10.1: 2.5)
terraform version                                 # tekshirish: Terraform v1.x.x

# Yangi loyiha papkasi
mkdir mening-infra && cd mening-infra              # bo'sh papka (root module — 2.11)
# main.tf faylini yozamiz (Misol 2), keyin:
terraform init                                     # provider yuklab oladi (2.6)
#  "Terraform has been successfully initialized!" (.terraform/ paydo bo'ladi)

# main.tf — eng oddiy to'liq misol (AWS EC2 yaratish)

terraform {
  required_version = ">= 1.5"            # Terraform CLI versiyasi (2.12)
  required_providers {
    aws = {
      source  = "hashicorp/aws"          # Registry'dagi provider (2.4)
      version = "~> 5.0"                  # 5.x ruxsat, 6.0 emas (2.12)
    }
  }
}

provider "aws" {                         # provider sozlash
  region = "eu-central-1"                # Frankfurt (10.6: 2.2)
}                                        #  kalitlar bu yerda EMAS — env/IAM role (10.6: 2.9)

resource "aws_instance" "web" {          # YARATILADIGAN EC2 (2.5)
  ami           = "ami-0abc1234567890"   # Ubuntu AMI (region'ga xos — Misol 5'da data bilan)
  instance_type = "t3.micro"             # arzon, free tier (10.6: 2.11)

  tags = {
    Name = "web-server"                  # AWS Console'da ko'rinadigan nom
  }
}

terraform plan      # nima yaratilishini ko'rsatadi 2.8-bob — "1 to add"
terraform apply     # "yes" so'raydi  haqiqatan EC2 yaratiladi (2.6)

# variables.tf — kiritiladigan qiymatlar (kodni dev/prod uchun moslaydi)

variable "instance_type" {
  type        = string
  default     = "t3.micro"               # berilmasa shu (2.9)
  description = "EC2 instance o'lchami"
}

variable "environment" {
  type        = string
  description = "Muhit nomi (dev/staging/prod)"
  # default yo'q  MAJBURIY (apply paytida so'raydi yoki tfvars'dan oladi)

  validation {                            # qiymatni tekshirish (faqat ruxsat etilgan)
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment faqat dev/staging/prod bo'lishi mumkin."
  }
}

# main.tf — variable'larni ishlatish
resource "aws_instance" "web" {
  ami           = "ami-0abc1234567890"
  instance_type = var.instance_type      # var.<nom> orqali (2.9)
  tags = {
    Name        = "web-${var.environment}"   # interpolatsiya: web-prod
    Environment = var.environment
  }
}

# prod.tfvars — production qiymatlari (alohida fayl)
environment   = "prod"
instance_type = "t3.large"               # prod kuchliroq

# dev.tfvars — development qiymatlari
# environment   = "dev"
# instance_type = "t3.micro"

# Qaysi muhit uchun apply qilayotganimizni TANLAYMIZ (bir kod, har xil qiymat)
terraform plan  -var-file="prod.tfvars"        # prod rejasini ko'r
terraform apply -var-file="prod.tfvars"        # prod'ni qo'lla
#  *.tfvars'da secret bo'lsa — .gitignore'ga qo'sh (10.11, 2.11)

# AMI ID'sini QO'LDA yozmaslik — eng yangi Ubuntu'ni AVTOMATIK topamiz (2.5)
data "aws_ami" "ubuntu" {
  most_recent = true                       # eng so'nggisi
  owners      = ["099720109477"]           # Canonical (Ubuntu rasmiy egasi)

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-noble-24.04-amd64-server-*"]
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id   # topilgan AMI'ni ishlatamiz (2.5)
  instance_type = var.instance_type
  #  endi AMI ID'sini har region uchun qo'lda izlamaymiz — Terraform topadi
}

# Security Group — virtual firewall (10.6: 2.5 — qo'lda emas, kodda)
resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Web server firewall (Terraform boshqaradi)"

  ingress {                                # KIRUVCHI: SSH — faqat o'z IP'ngga
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.10/32"]      #  0.0.0.0/0 EMAS (10.6: 2.5 xavfsizlik)
    description = "SSH faqat ofis IP"
  }

  ingress {                                # KIRUVCHI: HTTP/HTTPS — hammaga
    from_port   = 80
    to_port     = 443                      # 80-443 oralig'i
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]            # web ochiq
  }

  egress {                                 # CHIQUVCHI: hammasi ochiq (default)
    from_port   = 0
    to_port     = 0
    protocol    = "-1"                     # barcha protokol
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "web" {
  ami                    = data.aws_ami.ubuntu.id
  instance_type          = var.instance_type
  vpc_security_group_ids = [aws_security_group.web_sg.id]  # SG'ni biriktiramiz (2.8 havola)
}

# S3 bucket — kodda (10.6: 2.6 — qo'lda Console'da emas)
resource "aws_s3_bucket" "uploads" {
  bucket = "mening-loyiham-uploads-2026"   # GLOBAL noyob (10.6: 2.6)
  tags   = { Name = "Foydalanuvchi rasmlari" }
}

# Public kirishni BLOKLASH (default xavfsiz — 10.6: 2.6)
resource "aws_s3_bucket_public_access_block" "uploads" {
  bucket                  = aws_s3_bucket.uploads.id   # yuqoridagi bucket'ga havola
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true                       #  to'liq private (sizmasin)
}

# Versiyalash (tasodifan o'chgan faylni qaytarish — backup)
resource "aws_s3_bucket_versioning" "uploads" {
  bucket = aws_s3_bucket.uploads.id
  versioning_configuration { status = "Enabled" }
}

# outputs.tf — apply'dan keyin ko'rsatiladigan qiymatlar (2.9)
output "instance_public_ip" {
  value       = aws_instance.web.public_ip     # yaratilgan EC2 IP'si
  description = "Web server public IP (SSH/brauzer uchun)"
}

output "bucket_name" {
  value = aws_s3_bucket.uploads.bucket
}

output "ssh_command" {                          # tayyor SSH buyrug'i (qulay)
  value = "ssh ubuntu@${aws_instance.web.public_ip}"   # 10.1: 2.8
}

terraform apply
# Apply complete! Resources: 3 added, 0 changed, 0 destroyed.
# Outputs:
#   instance_public_ip = "203.0.113.5"
#   ssh_command        = "ssh ubuntu@203.0.113.5"
terraform output instance_public_ip            # bitta output'ni alohida olish

# backend.tf — state'ni S3'da saqlash (jamoa uchun — 2.10)
terraform {
  backend "s3" {
    bucket       = "mening-tfstate-2026"        # state saqlanadigan S3 (avval yaratilgan)
    key          = "prod/terraform.tfstate"     # bucket ichidagi yo'l
    region       = "eu-central-1"
    encrypt      = true                          # state SHIFRLANADI (2.7 — secret xavfi!)
    use_lockfile = true                          # NATIVE S3 lock (2026 — DynamoDB shart emas)
  }
}

# Lokal state'dan remote'ga ko'chirish (init backend'ni o'rnatadi)
terraform init -migrate-state                    # "yes"  state S3'ga ko'chadi
#  Endi jamoa bir state'dan ishlaydi, ikki kishi bir vaqtda apply qilolmaydi (lock — 2.10)
#  tfstate'ni Git'ga commit QILMA — .gitignore: *.tfstate, *.tfstate.*, .terraform/

# main.tf — tayyor VPC modulini Registry'dan chaqiramiz (2.11)
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"      # Terraform Registry (ommaviy)
  version = "5.0.0"                              # versiya qulflanadi (2.12)

  name = "mening-vpc"
  cidr = "10.0.0.0/16"                           # tarmoq diapazoni (10.6: 2.10)

  azs             = ["eu-central-1a", "eu-central-1b"]   # 2 AZ (10.6: 2.2)
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]       # public (EC2)
  private_subnets = ["10.0.11.0/24", "10.0.12.0/24"]     # private (RDS — 10.6: 2.10)
}

# Modul OUTPUT'iga murojaat (2.11)
resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  subnet_id     = module.vpc.public_subnets[0]   # modul yaratgan public subnet'ga qo'y
}

output "vpc_id" {
  value = module.vpc.vpc_id                       # modul qaytargan VPC ID (2.11)
}

# count — bir xil 3 ta EC2 (indeks bilan farqlanadi)
resource "aws_instance" "worker" {
  count         = 3                                # 3 nusxa (2.14)
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.micro"
  tags = { Name = "worker-${count.index}" }        # worker-0, worker-1, worker-2
}
# murojaat: aws_instance.worker[0].id  (ro'yxat — indeks bilan)

# for_each — NOMLI resurslar (turg'un kalit — o'chsa boshqasi tegmaydi — afzal)
resource "aws_instance" "service" {
  for_each      = toset(["web", "api", "worker"])  # 3 ta nomli (2.14)
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type
  tags = { Name = each.key }                       # each.key: "web"/"api"/"worker"
}
# murojaat: aws_instance.service["api"].public_ip  (kalit bilan)

# local — takrorlanuvchi qiymatlarga nom (bir marta yoz, hamma joyda ishlat — 2.15)
locals {
  project     = "mening-loyiham"
  common_tags = { Project = local.project, ManagedBy = "Terraform" }
  web_ports   = [80, 443, 8080]                    # ochiladigan portlar ro'yxati
}

# dynamic — takrorlanuvchi ingress bloklarini ro'yxatdan generatsiya (2.14)
resource "aws_security_group" "web_sg" {
  name = "web-sg"
  tags = local.common_tags                         # local'ni ishlatamiz (DRY)

  dynamic "ingress" {                              # local.web_ports uchun har biriga blok
    for_each = local.web_ports
    content {
      from_port   = ingress.value                  # ingress.value: 80, 443, 8080
      to_port     = ingress.value
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
    }
  }
}

resource "aws_instance" "web" {
  ami           = data.aws_ami.ubuntu.id
  instance_type = var.instance_type

  depends_on = [aws_s3_bucket.uploads]             # yashirin bog'liqlik (2.15)

  lifecycle {
    create_before_destroy = true                   # avval yangi, keyin eski (uzilishsiz — 2.14)
    ignore_changes        = [tags["LastScanned"]]  # tashqi tizim tegini e'tiborsiz qoldir
  }
}

# Production ma'lumotlar bazasi — tasodifan o'chmasin (2.14)
resource "aws_db_instance" "main" {
  identifier = "prod-db"
  # ...
  lifecycle {
    prevent_destroy = true                         # destroy'ni bloklaydi (himoya)
  }
}

# Bir provider — ikki region (alias bilan — 2.15)
provider "aws" {
  region = "eu-central-1"                          # asosiy (default) — Frankfurt
}
provider "aws" {
  alias  = "us"                                    # ikkinchi sozlama
  region = "us-east-1"                             # Virginia (masalan CloudFront/ACM uchun)
}

resource "aws_instance" "us_web" {
  provider      = aws.us                           # AYNAN us region provider'i (2.15)
  ami           = "ami-0abc1234567890"
  instance_type = "t3.micro"
}

# Mavjud (qo'lda yaratilgan) resursni Terraform boshqaruviga olish (2.15)
import {
  to = aws_instance.legacy                         # koddagi manzil
  id = "i-0abc123def456"                           # AWS'dagi haqiqiy ID
}
#  Mos "resource aws_instance legacy {...}" blokini QO'LDA yozib, keyin:
#    terraform plan   kod bilan haqiqat mos kelishini tekshiradi (farq bo'lsa ko'rsatadi)

# .github/workflows/terraform.yml — infratuzilmani avtomatik qo'llash (10.5)
name: Terraform
on:
  pull_request:            # PR'da faqat PLAN (o'zgarish ko'rinadi, review qilinadi — 2.8)
  push:
    branches: [main]       # main'ga merge bo'lganda APPLY (2.6)

jobs:
  terraform:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write # plan natijasini PR izohiga yozish uchun
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init
      - run: terraform fmt -check           # format buzilgan bo'lsa — fail (2.6, 8-bo'lim)
      - run: terraform validate             # sintaksis tekshiruvi (2.6)
      - run: terraform plan -no-color       # PR'da: nima o'zgarishini ko'rsatadi (2.8)
      - name: Apply (faqat main)
        if: github.ref == 'refs/heads/main' # PR'da EMAS — faqat merge'dan keyin
        run: terraform apply -auto-approve  # tasdiqlangan o'zgarishni qo'llaydi (2.6)
    env:                                    # AWS kalitlari — GitHub Secrets (kodda EMAS — 10.11)
      AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

 AWS Console'da qo'lda (ClickOps — takrorlab/hujjatlab bo'lmaydi — 2.1)
 Terraform kod — versiyalanadi, takrorlanadi, review qilinadi

 terraform.tfstate'ni Git'ga commit qilish (secret sizadi, konflikt — 2.7)
 Remote backend (S3 + encrypt + lock); tfstate'ni .gitignore'ga (2.10)

 Ko'rmasdan to'g'ridan apply (yoki -auto-approve hamma yerda)
 Avval terraform plan'ni o'qi, KEYIN apply (nima o'chayotganini tekshir — 2.8)

 ami = "ami-0abc..." qo'lda (har region boshqacha, eskiradi — 2.5)
 data "aws_ami" bilan avtomatik topish (har region'da ishlaydi — 2.5)

 DB parolini main.tf'ga yozish (kodda ochiq, git'ga ketadi — 2.12)
 tfvars (gitignore) yoki Vault/SSM; sensitive=true; encrypt (10.11, 2.11)

 version berilmagan (har init turli versiya — kutilmagan buzilish)
 version = "~> 5.0" + .terraform.lock.hcl commit (jamoa bir xil — 2.12)