variable "libvirt_uri" {
  description = "libvirt connection URI. Default assumes tofu/kubectl/flux all run directly on the T630 as the 'k8s' user (see docs/01-bootstrap.md step 2) - simplest option, since node IPs (network_cidr) are only directly reachable from the T630 itself. Use qemu+ssh://k8s@t630.lan/system?keyfile=... instead if you'd rather run Terraform from a separate workstation (you'll then need an SSH tunnel for kubectl/flux to reach node IPs - see docs/04-tofu.md step 3)."
  type        = string
  default     = "qemu:///system"
}

variable "base_image_url" {
  description = "Cloud image libvirt clones for every node's disk (downloaded once, cached in the pool)"
  type        = string
  default     = "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
}

variable "storage_pool" {
  description = "Name of the libvirt storage pool this project's disks live in (created if missing)"
  type        = string
  default     = "k3s-homelab"
}

variable "storage_pool_path" {
  description = "Host filesystem path backing the storage pool"
  type        = string
  default     = "/var/lib/libvirt/images/k3s-homelab"
}

variable "network_cidr" {
  description = "Subnet for the dedicated NAT network this project's VMs live on (isolated from any other libvirt networks already on the host)"
  type        = string
  default     = "10.20.30.0/24"
}

variable "gateway_ip" {
  description = "Gateway address within network_cidr (libvirt itself, on the host)"
  type        = string
  default     = "10.20.30.1"
}

variable "ssh_public_key" {
  description = "Public key injected into each VM via cloud-init for the 'k3s' admin user"
  type        = string
}

variable "k3s_token" {
  description = "Shared cluster token agents use to join the k3s server"
  type        = string
  sensitive   = true
}

variable "k8s_api_hostname" {
  description = "LAN-only hostname for the k3s API server, added to the server's TLS SAN list so client-cert kubeconfigs validate against it. Resolve it via local DNS only (never a public record) - see docs/04-tofu.md step 5."
  type        = string
  default     = "k8s-api.boglabob.com"
}

variable "nodes" {
  description = "k3s nodes to provision. Sizing is deliberately small (2 vCPU/2GB each = 6GB total) so this stays a demo, not a resource hog, alongside the T630's other services."
  type = map(object({
    role    = string # "server" or "agent"
    ip      = string # e.g. "10.20.30.11" - must be inside network_cidr
    vcpu    = number
    memory  = number # MiB
    disk_gb = number
  }))
  default = {
    "k3s-server-1" = { role = "server", ip = "10.20.30.11", vcpu = 2, memory = 2048, disk_gb = 20 }
    "k3s-agent-1"  = { role = "agent", ip = "10.20.30.12", vcpu = 2, memory = 2048, disk_gb = 20 }
    "k3s-agent-2"  = { role = "agent", ip = "10.20.30.13", vcpu = 2, memory = 2048, disk_gb = 20 }
  }
}