variable "talos_version" {
  type        = string
  default     = "v1.13.3"
  description = "Talos version"
}

variable "kubernetes_version" {
  type        = string
  default     = "v1.36.1"
  description = "Kubernetes version"
}

variable "cluster_name" {
  type        = string
  default     = "homelab-cluster"
  description = "Cluster name"
}

variable "cluster_id" {
  type        = string
  sensitive   = true
  description = "Globally unique cluster ID (base64 encoded)"
}

variable "cluster_secret" {
  type        = string
  sensitive   = true
  description = "Shared cluster secret (base64 encoded)"
}

variable "bootstrap_token" {
  type        = string
  sensitive   = true
  description = "Bootstrap token for joining cluster"
}

variable "machine_token" {
  type        = string
  sensitive   = true
  description = "Machine PKI token"
}

variable "machine_ca_crt" {
  type        = string
  sensitive   = true
  description = "Machine CA certificate (base64 encoded)"
}

variable "machine_ca_key" {
  type        = string
  sensitive   = true
  description = "Machine CA private key (base64 encoded)"
}

variable "kubernetes_ca_crt" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA certificate (base64 encoded)"
}

variable "kubernetes_ca_key" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA private key (base64 encoded)"
}

variable "etcd_ca_crt" {
  type        = string
  sensitive   = true
  description = "Etcd CA certificate (base64 encoded)"
}

variable "etcd_ca_key" {
  type        = string
  sensitive   = true
  description = "Etcd CA private key (base64 encoded)"
}

variable "aggregator_ca_crt" {
  type        = string
  sensitive   = true
  description = "Aggregator CA certificate (base64 encoded)"
}

variable "aggregator_ca_key" {
  type        = string
  sensitive   = true
  description = "Aggregator CA private key (base64 encoded)"
}

variable "service_account_key" {
  type        = string
  sensitive   = true
  description = "Service account private key (base64 encoded)"
}

variable "secretbox_encryption_secret" {
  type        = string
  sensitive   = true
  description = "Secretbox encryption secret (base64 encoded)"
}

variable "controlplane_configs" {
  type = map(object({
    hostname     = string
    lan_ip       = string
    lan_subnet   = string
    lan_gateway  = string
    install_disk = string
    longhorn_disks = list(object({
      device     = string
      mountpoint = string
    }))
    zone             = string
    allow_scheduling = bool
    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
    # remote talosctl/kubectl over the tunnel pass TLS verification.
    cloudflare_talos_sans     = optional(list(string), [])
    cloudflare_apiserver_sans = optional(list(string), [])
  }))
  description = "Control plane machine configurations, keyed by node"
}

variable "worker_configs" {
  type = map(object({
    hostname          = string
    lan_ip            = string
    lan_subnet        = string
    lan_gateway       = string
    install_disk      = string
    network_interface = optional(string, "eno1")
    zone              = string
    gpu_count         = optional(number, 0)
    factory_image     = optional(string)
    swap_size         = optional(string, "")
    extra_disks = optional(list(object({
      device     = string
      mountpoint = string
    })), [])
  }))
  default     = {}
  description = "Worker machine configurations, keyed by node"
}

variable "cluster_config" {
  type = object({
    controlplane_ip = string
    pod_subnets     = list(string)
    service_subnets = list(string)
    dns_servers     = list(string)
    dns_domain      = string
  })
  description = "Cluster-wide configuration"
}

variable "forgejo_registry_ip" {
  type        = string
  default     = "10.107.155.96"
  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
}

variable "forgejo_hostname" {
  type        = string
  default     = "forgejo.riotpiao.com"
  description = "Forgejo external hostname"
}