homelab/terraform/variables.tf

variable "talos_version" {
  type        = string
  default     = "v1.13.3"
  description = "Talos version"
}

variable "kubernetes_version" {
  type        = string
  default     = "v1.36.1"
  description = "Kubernetes version"
}

variable "cluster_name" {
  type        = string
  default     = "homelab-cluster"
  description = "Cluster name"
}

variable "cluster_id" {
  type        = string
  sensitive   = true
  description = "Globally unique cluster ID (base64 encoded)"
}

variable "cluster_secret" {
  type        = string
  sensitive   = true
  description = "Shared cluster secret (base64 encoded)"
}

variable "bootstrap_token" {
  type        = string
  sensitive   = true
  description = "Bootstrap token for joining cluster"
}

variable "machine_token" {
  type        = string
  sensitive   = true
  description = "Machine PKI token"
}

variable "machine_ca_crt" {
  type        = string
  sensitive   = true
  description = "Machine CA certificate (base64 encoded)"
}

variable "machine_ca_key" {
  type        = string
  sensitive   = true
  description = "Machine CA private key (base64 encoded)"
}

variable "kubernetes_ca_crt" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA certificate (base64 encoded)"
}

variable "kubernetes_ca_key" {
  type        = string
  sensitive   = true
  description = "Kubernetes CA private key (base64 encoded)"
}

variable "etcd_ca_crt" {
  type        = string
  sensitive   = true
  description = "Etcd CA certificate (base64 encoded)"
}

variable "etcd_ca_key" {
  type        = string
  sensitive   = true
  description = "Etcd CA private key (base64 encoded)"
}

variable "aggregator_ca_crt" {
  type        = string
  sensitive   = true
  description = "Aggregator CA certificate (base64 encoded)"
}

variable "aggregator_ca_key" {
  type        = string
  sensitive   = true
  description = "Aggregator CA private key (base64 encoded)"
}

variable "service_account_key" {
  type        = string
  sensitive   = true
  description = "Service account private key (base64 encoded)"
}

variable "secretbox_encryption_secret" {
  type        = string
  sensitive   = true
  description = "Secretbox encryption secret (base64 encoded)"
}

variable "controlplane_configs" {
  type = map(object({
    hostname        = string
    lan_ip          = string
    lan_subnet      = string
    lan_gateway     = string
    wg0_ip          = optional(string)
    wg0_subnet      = optional(string)
    wg0_port        = optional(number)
    wg0_private_key = optional(string)
    wg0_peers = optional(list(object({
      public_key  = string
      allowed_ips = list(string)
    })), [])
    wg1_ip          = optional(string)
    wg1_subnet      = optional(string)
    wg1_port        = optional(number)
    wg1_private_key = optional(string)
    wg1_peers = optional(list(object({
      public_key                = string
      allowed_ips               = list(string)
      persistent_keepalive_secs = number
    })), [])
    install_disk = string
    longhorn_disks = list(object({
      device     = string
      mountpoint = string
    }))
    zone             = string
    allow_scheduling = bool
    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
    # remote talosctl/kubectl over the tunnel pass TLS verification.
    cloudflare_talos_sans     = optional(list(string), [])
    cloudflare_apiserver_sans = optional(list(string), [])
  }))
  description = "Control plane machine configurations, keyed by node"
}

variable "cluster_config" {
  type = object({
    controlplane_ip = string
    pod_subnets     = list(string)
    service_subnets = list(string)
    dns_servers     = list(string)
    dns_domain      = string
  })
  description = "Cluster-wide configuration"
}

variable "forgejo_registry_ip" {
  type        = string
  default     = "10.107.155.96"
  description = "Forgejo registry (container repo) ClusterIP for host DNS rewrite"
}

variable "forgejo_hostname" {
  type        = string
  default     = "forgejo.riotpiao.com"
  description = "Forgejo external hostname"
}