# Copy to terraform.tfvars.local (git-ignored) and fill in.
# Secrets never belong in a committed file: pass them as environment variables
# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.

# ── Cloudflare (existing zone) ───────────────────────────────────────────────
cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
tunnel_id          = "REPLACE_WITH_TUNNEL_UUID"

# Adopt existing records with `terraform import` before the first apply, or the
# create call collides with the hand-made record of the same name.
cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]

# Leave false until the tunnel config import is understood. True makes
# Terraform replace the entire ingress list with tunnel_ingress.
manage_tunnel_config = false
tunnel_ingress       = {}

# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
china_domain   = "REPLACE.example.cn"
china_hostnames = ["paperless", "img"]

# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
# ap-singapore when no filing exists.
tencent_region            = "ap-guangzhou"
tencent_availability_zone = "ap-guangzhou-6"
relay_instance_type       = "S5.SMALL2"
relay_image_id            = "REPLACE_WITH_IMAGE_ID"
relay_ssh_public_key      = "ssh-ed25519 AAAA... operator@laptop"
relay_admin_cidr          = "REPLACE_WITH_OPERATOR_CIDR"

# ── WireGuard between the relay and the cluster ──────────────────────────────
# The relay private key comes from `wg genkey`. Keep it in the environment, or
# in a SOPS file mounted for the run. It is not written by this module.
wireguard_port                 = 51820
wireguard_homelab_public_key   = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
wireguard_relay_address        = "10.88.0.1/24"
wireguard_homelab_address      = "10.88.0.2/24"