variable "cloudflare_api_token" {
  description = "Cloudflare API token with Zone:DNS:Edit and, for tunnel config, Account:Cloudflare Tunnel:Edit."
  type        = string
  sensitive   = true
  default     = null
}

variable "cloudflare_zone_id" {
  description = "Zone ID of the existing public zone (riotpiao.com)."
  type        = string
}

variable "cloudflare_account_id" {
  description = "Account ID. Required only when manage_tunnel_config is true."
  type        = string
  default     = null
}

variable "tunnel_id" {
  description = "UUID of the cloudflared tunnel that the DNS records point at."
  type        = string
}

# The dashboard remains the source of truth for the remotely-managed tunnel
# today. Setting this true hands that config to Terraform, which then rewrites
# the whole ingress list: every hostname not listed in tunnel_ingress is
# removed from the tunnel. Import first and read the plan before applying.
variable "manage_tunnel_config" {
  description = "Take ownership of the remotely-managed tunnel configuration."
  type        = bool
  default     = false
}

variable "tunnel_ingress" {
  description = "hostname => origin service, used only when manage_tunnel_config is true."
  type        = map(string)
  default     = {}
}

# ── DNS records managed in the Cloudflare zone ───────────────────────────────
# These names already exist, created by hand in the dashboard. Adopt them with
# `terraform import` before the first apply, or Terraform will try to create a
# second record with the same name and Cloudflare will reject it.
variable "cloudflare_tunnel_hostnames" {
  description = "Hostnames in the Cloudflare zone that must CNAME to the tunnel."
  type        = list(string)
  default     = []
}

# ── China edge ───────────────────────────────────────────────────────────────
variable "china_domain" {
  description = "The .cn domain served from Tencent Cloud, without a trailing dot."
  type        = string
}

variable "china_hostnames" {
  description = "Subdomains of china_domain that point at the Tencent relay."
  type        = list(string)
  default     = ["paperless", "img"]
}

variable "tencent_secret_id" {
  description = "Tencent Cloud SecretId. Prefer TENCENTCLOUD_SECRET_ID in the environment."
  type        = string
  sensitive   = true
  default     = null
}

variable "tencent_secret_key" {
  description = "Tencent Cloud SecretKey. Prefer TENCENTCLOUD_SECRET_KEY in the environment."
  type        = string
  sensitive   = true
  default     = null
}

variable "tencent_region" {
  description = "Tencent Cloud region for the relay. Mainland regions need an ICP filing for the domain."
  type        = string
  default     = "ap-guangzhou"
}

variable "tencent_availability_zone" {
  description = "Availability zone inside tencent_region."
  type        = string
  default     = "ap-guangzhou-6"
}

variable "relay_instance_type" {
  description = "CVM spec for the relay. A relay only terminates TLS and forwards bytes."
  type        = string
  default     = "S5.SMALL2"
}

variable "relay_image_id" {
  description = "CVM image ID. Find one with: tencentcloud images --image-name 'Ubuntu 24.04' (or the console)."
  type        = string
}

variable "relay_ssh_public_key" {
  description = "Public key injected into the relay for break-glass SSH. Never the private key."
  type        = string
}

variable "relay_admin_cidr" {
  description = "CIDR allowed to reach SSH on the relay. Keep it to the operator, not 0.0.0.0/0."
  type        = string
}

variable "wireguard_port" {
  description = "UDP port of the WireGuard listener on the relay."
  type        = number
  default     = 51820
}

variable "wireguard_relay_private_key" {
  description = "WireGuard private key of the relay side. Generate with `wg genkey`; pass via TF_VAR_wireguard_relay_private_key."
  type        = string
  sensitive   = true
}

variable "wireguard_homelab_public_key" {
  description = "WireGuard public key of the homelab peer that dials the relay."
  type        = string
}

variable "wireguard_relay_address" {
  description = "Tunnel address of the relay side."
  type        = string
  default     = "10.88.0.1/24"
}

variable "wireguard_homelab_address" {
  description = "Tunnel address of the homelab side."
  type        = string
  default     = "10.88.0.2/24"
}