variable "project_id" {
  description = "GCP project to deploy into."
  type        = string
}

variable "region" {
  description = "GCP region to deploy into."
  type        = string
}

variable "zone" {
  description = "GCP zone to deploy the VMs into."
  type        = string
}

variable "name" {
  description = "Base name used to derive resource names."
  type        = string
  default     = "vpn-router-example"
}

variable "admin_username" {
  description = "Admin username created on both VMs via SSH key metadata."
  type        = string
  default     = "vpnrouter"
}

variable "admin_ssh_public_key" {
  description = "SSH public key installed for admin_username on both VMs."
  type        = string
}

variable "machine_type" {
  description = "Machine type for the router."
  type        = string
  default     = "e2-small"
}

variable "local_fqdn" {
  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
  type        = string
}

variable "dns_managed_zone" {
  description = "Name of an existing Cloud DNS managed zone to create local_fqdn's A record in, pointing at the router's public IP. local_fqdn must be a name within that zone's DNS name. Leave empty to skip - local_fqdn is then just a label with nothing making it resolve."
  type        = string
  default     = ""
}

variable "dns_project" {
  description = "Project that owns dns_managed_zone. Leave empty to use project_id."
  type        = string
  default     = ""
}

variable "local_id_mode" {
  description = "IKE local identity source: fqdn, public_ip or internal_ip."
  type        = string
  default     = "fqdn"
}

variable "local_cidrs" {
  description = "Local subnet CIDR(s) advertised into the site-to-site tunnel. Should include the workload subnet CIDR."
  type        = string
}

variable "remote_addrs" {
  description = "Remote gateway address(es) or FQDN for the site-to-site tunnel."
  type        = string
}

variable "remote_id" {
  description = "Remote peer's IKE identity, without a leading @."
  type        = string
}

variable "remote_cidrs" {
  description = "Remote subnet CIDR(s) reachable through the site-to-site tunnel."
  type        = string
}

variable "psk" {
  description = "Pre-shared key for the site-to-site IKEv2 tunnel."
  type        = string
  sensitive   = true
}

variable "p2s_enabled" {
  description = "Enable road-warrior (P2S) access."
  type        = bool
  default     = false
}

variable "p2s_address_pool" {
  description = "CIDR block assigned to road-warrior clients."
  type        = string
  default     = ""
}

variable "ca_cert_file" {
  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
  type        = string
  default     = ""
}

variable "server_cert_file" {
  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
  type        = string
  default     = ""
}

variable "server_key_file" {
  description = "Path to an existing server private key PEM, paired with ca_cert_file."
  type        = string
  default     = ""
  sensitive   = true
}

variable "wireguard_enabled" {
  description = "Enable the WireGuard endpoint."
  type        = bool
  default     = false
}

variable "wireguard_address" {
  description = "Address and prefix length for the wg0 interface."
  type        = string
  default     = ""
}

variable "wireguard_listen_port" {
  description = "UDP port WireGuard listens on."
  type        = number
  default     = 51820
}

variable "deploy_workload_vm" {
  description = "Deploy a bare VM on the workload subnet, for manually verifying routing through the router."
  type        = bool
  default     = false
}

variable "repo_url" {
  description = "Base URL of the Debian package repository the router pulls vpn-router from."
  type        = string
  default     = "https://gitea.koszewscy.waw.pl/api/packages/slawek/debian"
}

variable "ubuntu_codename" {
  description = "Ubuntu release codename of the router VM's image, used to select the apt repo component."
  type        = string
  default     = "noble"
}

variable "ext_subnet_cidr" {
  description = "CIDR of the router's external (WAN-facing) subnet, in its own VPC network."
  type        = string
  default     = "10.0.1.0/24"
}

variable "int_subnet_cidr" {
  description = "CIDR of the router's internal (protected-network-facing) subnet, in its own VPC network."
  type        = string
  default     = "10.0.2.0/24"
}

variable "workload_subnet_cidr" {
  description = "CIDR of the demo protected workload subnet, in the same VPC network as int_subnet_cidr and routed through the router."
  type        = string
  default     = "10.0.3.0/24"
}