variable "proxmox_endpoint" {
  description = "Proxmox VE API endpoint, e.g. https://turtle-proxmox-01.home.turtlesystems.co.uk:8006/"
  type        = string
}

variable "proxmox_api_token" {
  description = <<-EOT
    Proxmox API token in `USER@REALM!TOKENID=SECRET` form. Sourced from Vault
    (homelab/ci/proxmox), never committed — pass via the TF_VAR_proxmox_api_token
    environment variable.
  EOT
  type        = string
  sensitive   = true
}

variable "proxmox_insecure" {
  description = "Skip TLS verification — true while Proxmox has a self-signed cert."
  type        = bool
  default     = true
}

variable "proxmox_node" {
  description = <<-EOT
    Proxmox node guests are created on. Must be the node's **short** name as
    the cluster knows it (`pvecm nodes`), never an FQDN, even though the API
    endpoint is one.

    pveproxy compares this against its own short hostname to decide whether a
    request is local. An FQDN never matches, so it proxies the request onward
    — to itself — over a connection it verifies against the cluster CA, which
    a self-signed cert fails. The result is an HTTP 596 carrying an OpenSSL
    `certificate verify failed`, which reads like a TLS misconfiguration on
    this side and is not: `proxmox_insecure` governs the provider's own
    connection and has no bearing on Proxmox's internal one.
  EOT
  type        = string
  default     = "turtle-proxmox-02"
}

variable "proxmox_replication_node" {
  description = <<-EOT
    The other node in the cluster, which guests on a ZFS pool replicate to.
    Only the shared Postgres module uses this today; it lives here rather than
    in that module's own defaults because it names a node of this cluster, the
    same as `proxmox_node` does.

    Null disables replication. Set it explicitly even on a single-node
    cluster — a null default is indistinguishable from an oversight, and the
    failure mode is a database with no second copy that looks entirely
    healthy.
  EOT
  type        = string
  default     = "turtle-proxmox-01"
}

variable "lxc_template_file_id" {
  description = <<-EOT
    Container template every LXC module is built from, e.g.
    `local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst`. Must already be
    downloaded on the node — `pveam list local` shows what is there, `pveam
    available`/`pveam download local <name>` fetches one. Not defaulted: the
    exact filename moves with each point release, so a stale default would fail
    at apply time rather than here.
  EOT
  type        = string
}

variable "ssh_public_keys" {
  description = <<-EOT
    Public keys installed for root in every container, so Ansible can reach
    them. The matching private key is in Vault at `homelab/ci/ssh` — see "SSH
    access" in the top-level README.md. Public keys aren't secret, but they are
    site-specific, so pass rather than commit:

      export TF_VAR_ssh_public_keys='["'"$(cat ~/.ssh/unraid_ansible.pub)"'"]'
  EOT
  type        = list(string)
}