variable "subscription_id" {
  description = "Azure subscription ID to deploy into."
  type        = string
}

variable "tenant_id" {
  description = "Azure AD tenant ID. Leave empty to use the tenant of the credentials Terraform is running with."
  type        = string
  default     = ""
}

variable "location" {
  description = "Azure region to deploy into."
  type        = string
}

variable "name" {
  description = "Base name used to derive resource names."
  type        = string
  default     = "vpn-router-example"
}

variable "admin_ssh_public_key" {
  description = "SSH public key installed for the admin_username on both VMs."
  type        = string
}

variable "admin_username" {
  description = "Admin username on both VMs."
  type        = string
  default     = "azureuser"
}

variable "admin_password" {
  description = "Admin password for the router VM. SSH key auth is always configured; leaving this empty additionally disables password authentication, setting it enables password auth alongside the key."
  type        = string
  default     = ""
  sensitive   = true
}

variable "vm_size" {
  description = "VM size for the router."
  type        = string
  default     = "Standard_B2ls_v2"
}

variable "local_fqdn" {
  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_zone_id is set, as the name of the A record created for it."
  type        = string
}

variable "dns_zone_id" {
  description = "Resource ID of an existing Azure DNS zone to create local_fqdn's A record in, pointing at the router's public IP. local_fqdn must be a name within that zone. Leave null to skip - local_fqdn is then just a label with nothing making it resolve."
  type        = string
  nullable    = true
  default     = null
}

variable "local_id_mode" {
  description = "IKE local identity source: fqdn, public_ip or internal_ip."
  type        = string
  default     = "fqdn"
}

variable "local_cidrs" {
  description = "Local subnet CIDR(s) advertised into the site-to-site tunnel. Should include the workload subnet CIDR."
  type        = string
}

variable "remote_addrs" {
  description = "Remote gateway address(es) or FQDN for the site-to-site tunnel."
  type        = string
}

variable "remote_id" {
  description = "Remote peer's IKE identity, without a leading @."
  type        = string
}

variable "remote_cidrs" {
  description = "Remote subnet CIDR(s) reachable through the site-to-site tunnel."
  type        = string
}

variable "psk" {
  description = "Pre-shared key for the site-to-site IKEv2 tunnel."
  type        = string
  sensitive   = true
}

variable "p2s_enabled" {
  description = "Enable road-warrior (P2S) access."
  type        = bool
  default     = false
}

variable "p2s_address_pool" {
  description = "CIDR block assigned to road-warrior clients."
  type        = string
  default     = ""
}

variable "ca_cert_file" {
  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
  type        = string
  default     = ""
}

variable "server_cert_file" {
  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
  type        = string
  default     = ""
}

variable "server_key_file" {
  description = "Path to an existing server private key PEM, paired with ca_cert_file."
  type        = string
  default     = ""
  sensitive   = true
}

variable "wireguard_enabled" {
  description = "Enable the WireGuard endpoint."
  type        = bool
  default     = false
}

variable "wireguard_address" {
  description = "Address and prefix length for the wg0 interface."
  type        = string
  default     = ""
}

variable "wireguard_listen_port" {
  description = "UDP port WireGuard listens on."
  type        = number
  default     = 51820
}

variable "deploy_workload_vm" {
  description = "Deploy a bare VM on the workload subnet, for manually verifying routing through the router."
  type        = bool
  default     = false
}

variable "repo_url" {
  description = "Base URL of the Debian package repository the router pulls vpn-router from."
  type        = string
  default     = "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian"
}

variable "ubuntu_codename" {
  description = "Ubuntu release codename of the router VM's image, used to select the apt repo component."
  type        = string
  default     = "noble"
}

variable "vnet_address_space" {
  description = "Address space of the example VNet."
  type        = string
  default     = "10.0.0.0/16"
}

variable "ext_subnet_cidr" {
  description = "CIDR of the router's external (WAN-facing) subnet."
  type        = string
  default     = "10.0.1.0/24"
}

variable "int_subnet_cidr" {
  description = "CIDR of the router's internal (protected-network-facing) subnet."
  type        = string
  default     = "10.0.2.0/24"
}

variable "workload_subnet_cidr" {
  description = "CIDR of the demo protected workload subnet, routed through the router."
  type        = string
  default     = "10.0.3.0/24"
}