variable "location" {
  description = "Hetzner Cloud datacenter location for all servers and volumes."
  type        = string
  default     = "nbg1"
}

variable "network_zone" {
  description = "Hetzner Cloud network zone matching var.location."
  type        = string
  default     = "eu-central"
}

variable "server_image" {
  description = "OS image used for all servers."
  type        = string
  default     = "ubuntu-24.04"
}

variable "dev_server_type" {
  description = "Server type for dev"
  type        = string
  default     = "cx22"
}

variable "prod_server_type" {
  description = "Server type for prod"
  type        = string
  default     = "cx22"
}

variable "vpn_server_type" {
  description = "Server type for vpn"
  type        = string
  default     = "cx22"
}

variable "dev_volume_size" {
  description = "Size in GB of the volume attached to dev"
  type        = number
  default     = 20
}

variable "prod_volume_size" {
  description = "Size in GB of the volume attached to prod (disk1 in docs/architecture.md)."
  type        = number
  default     = 20
}

variable "network_ip_range" {
  description = "IP range of the private network shared by dev and prod."
  type        = string
  default     = "10.0.0.0/16"
}

variable "subnet_ip_range" {
  description = "IP range of the network subnet shared by dev and prod."
  type        = string
  default     = "10.0.1.0/24"
}

variable "dev_private_ip" {
  description = "Private network IP for dev."
  type        = string
  default     = "10.0.1.10"
}

variable "prod_private_ip" {
  description = "Private network IP for prod."
  type        = string
  default     = "10.0.1.11"
}

variable "ssh_key_names" {
  description = "Names of SSH keys already uploaded to your Hetzner Cloud project (Console > Security > SSH Keys). All are installed on every server."
  type        = list(string)
}

variable "allowed_ssh_source_ips" {
  description = "CIDRs allowed to reach port 22 on the vpn server. Narrow this to your own IP(s) once known. dev and prod don't use this - their SSH is restricted to the vpn server's own public IP instead (see infra/main.tf)."
  type        = list(string)
  default     = ["0.0.0.0/0", "::/0"]
}

variable "dns_zones" {
  description = "Domains to manage as Hetzner DNS zones. Point each domain's registrar NS records at tofu output dns_nameservers for Hetzner to actually become authoritative."
  type        = list(string)
  default     = ["luke-else.co.uk", "divine-couture.co.uk", "snexo.co.uk"]
}