variable "talos_version" {
  type        = string
  default     = "v1.13.3"
  description = "Talos version"
}

variable "kubernetes_version" {
  type        = string
  default     = "v1.36.1"
  description = "Kubernetes version"
}

variable "cluster_name" {
  type        = string
  default     = "homelab-cluster"
  description = "Cluster name"
}

variable "cluster_id" {
  type        = string
  sensitive   = true
  description = "Globally unique cluster ID (base64 encoded)"
}

variable "cluster_secret" {
  type        = string
  sensitive   = true
  description = "Shared cluster secret (base64 encoded)"
}

variable "bootstrap_token" {
  type        = string
  sensitive   = true
  description = "Bootstrap token for joining cluster"
}

variable "machine_token" {
  type        = string
  sensitive   = true
  description = "Machine PKI token"
}

variable "machine_ca_crt" {
  type        = string
  sensitive   = true
  description = "Machine CA certificate (base64 encoded)"
}

variable "machine_ca_key" {
  type        = string
  sensitive   = true
  description = "Machine CA private key (base64 encoded)"
}

variable "kubernetes_ca_crt" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA certificate (base64 encoded)"
}

variable "kubernetes_ca_key" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA private key (base64 encoded)"
}

variable "etcd_ca_crt" {
  type        = string
  sensitive   = true
  description = "Etcd CA certificate (base64 encoded)"
}

variable "etcd_ca_key" {
  type        = string
  sensitive   = true
  description = "Etcd CA private key (base64 encoded)"
}

variable "aggregator_ca_crt" {
  type        = string
  sensitive   = true
  description = "Aggregator CA certificate (base64 encoded)"
}

variable "aggregator_ca_key" {
  type        = string
  sensitive   = true
  description = "Aggregator CA private key (base64 encoded)"
}

variable "service_account_key" {
  type        = string
  sensitive   = true
  description = "Service account private key (base64 encoded)"
}

variable "secretbox_encryption_secret" {
  type        = string
  sensitive   = true
  description = "Secretbox encryption secret (base64 encoded)"
}

variable "controlplane_configs" {
  type = map(object({
    hostname     = string
    lan_ip       = string
    lan_subnet   = string
    lan_gateway  = string
    install_disk = string
    # Longhorn data disks, in mountpoint order. `device` should be a stable
    # /dev/disk/by-id/wwn-* path: this hardware enumerates /dev/sdX by discovery
    # order, and `install.wipe: true` means a renumber can aim the installer at a
    # data disk.
    #
    # `mountpoint` defaults to /var/lib/longhorn-disk<N> by position. Never
    # renumber or reorder existing entries — Longhorn keys its disks off the
    # mountpoint, so a rename orphans the replicas already on that disk. Append
    # new disks to the end.
    #
    # `kind` ("ssd"/"hdd") is a declared label only. PERC RAID controllers report
    # every disk as rotational, so it can't be autodetected, and it deliberately
    # does not affect ordering or mountpoints.
    longhorn_disks = optional(list(object({
      device     = string
      mountpoint = optional(string)
      kind       = optional(string, "hdd")
    })), [])
    zone             = string
    allow_scheduling = bool
    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
    # remote talosctl/kubectl over the tunnel pass TLS verification.
    cloudflare_talos_sans     = optional(list(string), [])
    cloudflare_apiserver_sans = optional(list(string), [])
  }))
  description = "Control plane machine configurations, keyed by node"
}

variable "worker_configs" {
  type = map(object({
    hostname          = string
    lan_ip            = string
    lan_subnet        = string
    lan_gateway       = string
    install_disk      = string
    network_interface = optional(string, "eno1")
    zone              = string
    gpu_count         = optional(number, 0)
    # Extra node labels beyond the topology/GPU defaults.
    node_labels = optional(map(string), {})
    # Taints make a node dedicated: only pods carrying a matching toleration
    # schedule there. effect is NoSchedule | PreferNoSchedule | NoExecute.
    node_taints = optional(list(object({
      key    = string
      value  = string
      effect = string
    })), [])
    factory_image      = optional(string)
    swap_size          = optional(string, "")
    ephemeral_max_size = optional(string, "700GiB")
    extra_disks = optional(list(object({
      device     = string
      mountpoint = string
    })), [])
  }))
  default     = {}
  description = "Worker machine configurations, keyed by node"
}

variable "cluster_config" {
  type = object({
    controlplane_ip = string
    pod_subnets     = list(string)
    service_subnets = list(string)
    dns_servers     = list(string)
    dns_domain      = string
  })
  description = "Cluster-wide configuration"
}

variable "forgejo_registry_ip" {
  type        = string
  default     = "10.107.155.96"
  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
}

variable "forgejo_hostname" {
  type        = string
  default     = "forgejo.riotpiao.com"
  description = "Forgejo external hostname"
}