# terraform/edge — the China-facing edge, plus DNS ownership for the existing zone
#
# Purpose: give users in mainland China a short, stable path to the homelab
# without touching the Cloudflare path that serves everyone else.
#
#   China user -> <service>.<china_domain> -> Tencent CVM (this module)
#              -> WireGuard tunnel -> ingress-nginx (192.168.1.160) -> service
#
#   Everyone else -> Cloudflare -> cloudflared tunnel -> same ingress (unchanged)
#
# The homelab still opens no inbound port: the tunnel is established outbound
# from the cluster to the CVM.
#
# Credentials come from the environment, never from a file in git:
#   export CLOUDFLARE_API_TOKEN=...
#   export TENCENTCLOUD_SECRET_ID=...
#   export TENCENTCLOUD_SECRET_KEY=...
#   terraform -chdir=terraform/edge init
#   terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
#
# State is local and git-ignored. It carries no
# credential today, but it will once InstanceData or certificates are added, so
# treat it as a secret and move it to MinIO before a second operator applies.
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "5.28.1"
    }
    tencentcloud = {
      source  = "tencentcloudstack/tencentcloud"
      version = "1.83.38"
    }
  }
}

provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

provider "tencentcloud" {
  secret_id  = var.tencent_secret_id
  secret_key = var.tencent_secret_key
  region     = var.tencent_region
}