output "cloudflare_records" {
  description = "Hostnames now managed in the Cloudflare zone."
  value       = sort(keys(cloudflare_dns_record.tunnel))
}

output "tunnel_config_managed" {
  description = "Whether Terraform owns the tunnel ingress list. False means the dashboard still does."
  value       = var.manage_tunnel_config
}

output "relay_public_ip" {
  description = "Public address of the Tencent relay. Point the .cn DNS at it, or let the module do it."
  value       = tencentcloud_instance.relay.public_ip
}

output "china_hostnames" {
  description = "Fully qualified China hostnames served by the relay."
  value       = [for host in var.china_hostnames : "${host}.${var.china_domain}"]
}

output "wireguard_peer" {
  description = "Peer stanza for the homelab side. Add it to the cluster's wg0.conf; the relay already trusts this public key."
  value       = <<-EOT
    [Peer]
    PublicKey = <relay public key; see /etc/wireguard/wg0.conf on the relay>
    Endpoint = ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}
    AllowedIPs = ${var.wireguard_relay_address}
    PersistentKeepalive = 25
  EOT
}

output "next_manual_steps" {
  description = "What this module cannot do for you."
  value = [
    "Confirm the ICP filing for ${var.china_domain} if the relay is in a mainland region.",
    "Issue a certificate for the China hostnames on the relay (Caddy ACME needs the DNS-01 challenge for a .cn domain).",
    "Run a WireGuard peer in the cluster that dials ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}.",
    "Add the .cn origins to the OIDC client redirect URIs before any China user logs in.",
  ]
}