refactor(edge,iam): apply best practices to relay and Zitadel config

- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables
- edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers
- edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs
- edge: mark user_data sensitive and add prevent_destroy to the relay instance
- edge: validate relay_admin_cidr and Cloudflare hostnames
- edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs
- iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes
- iam: keep login hardened; drop unsupported login PDB

terraform/edge/variables.tf

@@ -45,6 +45,23 @@ variable "cloudflare_tunnel_hostnames" {
   description = "Hostnames in the Cloudflare zone that must CNAME to the tunnel."
   type        = list(string)
   default     = []
+
+  validation {
+    condition     = alltrue([for h in var.cloudflare_tunnel_hostnames : can(regex("^[a-zA-Z0-9._-]+$", h))])
+    error_message = "cloudflare_tunnel_hostnames entries must be DNS labels or relative names (letters, digits, dot, underscore, hyphen)."
+  }
+}
+
+variable "cloudflare_dns_ttl" {
+  description = "TTL for tunnel CNAME records. 1 means automatic, which is required when proxied is true."
+  type        = number
+  default     = 1
+}
+
+variable "cloudflare_dns_proxied" {
+  description = "Whether tunnel CNAME records are proxied through Cloudflare. Must stay true for a tunnel origin."
+  type        = bool
+  default     = true
 }
 
 # ── China edge ───────────────────────────────────────────────────────────────
@@ -102,8 +119,13 @@ variable "relay_ssh_public_key" {
 }
 
 variable "relay_admin_cidr" {
-  description = "CIDR allowed to reach SSH on the relay. Keep it to the operator, not 0.0.0.0/0."
+  description = "CIDR allowed to reach SSH and WireGuard on the relay. Keep it to the operator, not 0.0.0.0/0."
   type        = string
+
+  validation {
+    condition     = var.relay_admin_cidr != "0.0.0.0/0" && var.relay_admin_cidr != "::/0"
+    error_message = "relay_admin_cidr must not be the whole internet. Set the operator's egress CIDR."
+  }
 }
 
 variable "wireguard_port" {
@@ -134,3 +156,66 @@ variable "wireguard_homelab_address" {
   type        = string
   default     = "10.88.0.2/24"
 }
+
+# ── Relay networking / sizing ───────────────────────────────────────────────
+variable "edge_vpc_cidr" {
+  description = "CIDR of the relay VPC."
+  type        = string
+  default     = "10.66.0.0/16"
+}
+
+variable "edge_subnet_cidr" {
+  description = "CIDR of the relay subnet."
+  type        = string
+  default     = "10.66.1.0/24"
+}
+
+variable "relay_internet_max_bandwidth_out" {
+  description = "Peak outbound bandwidth in Mbps. The relay only terminates TLS and forwards bytes."
+  type        = number
+  default     = 20
+}
+
+variable "relay_system_disk_type" {
+  description = "System disk type for the relay."
+  type        = string
+  default     = "CLOUD_PREMIUM"
+}
+
+variable "relay_system_disk_size" {
+  description = "System disk size in GB for the relay."
+  type        = number
+  default     = 50
+}
+
+# ── DNS records ──────────────────────────────────────────────────────────────
+variable "china_dns_ttl" {
+  description = "TTL in seconds for the .cn A records."
+  type        = number
+  default     = 600
+}
+
+variable "china_dns_record_line" {
+  description = "DNSPod line for the .cn A records. Use 默认 for the default line."
+  type        = string
+  default     = "默认"
+}
+
+# ── Caddy reverse proxy ──────────────────────────────────────────────────────
+variable "wireguard_homelab_allowed_ips" {
+  description = "AllowedIPs for the homelab peer. Must include the homelab LAN so Caddy can reach ingress-nginx over the tunnel."
+  type        = string
+  default     = "10.88.0.2/32,192.168.1.0/24"
+}
+
+variable "ingress_upstream" {
+  description = "Upstream URL Caddy proxies to over WireGuard (the homelab ingress-nginx)."
+  type        = string
+  default     = "http://192.168.1.160:80"
+}
+
+variable "acme_email" {
+  description = "Contact email for Caddy ACME (Let's Encrypt)."
+  type        = string
+  default     = "[email protected]"
+}