# Inner-root inputs. The two connection values (transit IP + ssh user) are MEASURED
# after vvr1-dc0 boots (hard rule 2 -- not invented); the rest mirror the outer root.

variable "vvr1_dc0_transit_ip" {
  description = "vvr1-dc0's static transit IP (D-124 Scheme A, NetBox-assigned) -- where this root's qemu+ssh inner provider connects. MEASURED after the outer apply boots vvr1-dc0."
  type        = string
}

variable "vvr1_dc0_ssh_user" {
  description = "SSH user on vvr1-dc0 for the qemu+ssh inner provider (the cloud-init user, e.g. jessea123). Key auth + known_hosts verified out of band (NO no_verify)."
  type        = string
  default     = "jessea123"
}

variable "vvr1_dc0_ssh_keyfile" {
  description = "PATH (on the EXECUTING host, i.e. voffice1 per D-128) to the dc0 private key for the qemu+ssh provider. A path, never key material (D-126 secrets boundary). REQUIRED: measured 2026-07-20 that the provider's ssh dial reads NEITHER ~/.ssh/config nor default identity paths -- without an explicit keyfile URI param it attempts no auth methods at all."
  type        = string
}

variable "inner_pool_path" {
  description = "Directory path INSIDE vvr1-dc0 for the inner libvirt storage pool that backs the node/edge disks (created by the bootstrap step)."
  type        = string
  default     = "/var/lib/libvirt/vr1-dc0-inner"
}

variable "opnsense_base_path" {
  description = "Path ON THE EXECUTING HOST (voffice1, D-128 Plane 2) to the prepped OPNsense nano qcow2. CORRECTED 2026-07-20 (measured at the first inner apply): the remote qemu+ssh provider UPLOADS volume content from ITS OWN filesystem -- a path on vvr1-dc0 fails with 'Could not open URL for upload: failed to stat'. The rack-side prep (bootstrap step) still stages the image; copy it to the executing host (or prep there directly) before the inner apply."
  type        = string
  # 26.7 per operator ruling 2026-07-20 (fresh 26.7 nano base for the DC edge; the
  # office1 edge's proven 26.1 boot path becomes a REVALIDATION item at the step-C
  # boot gate -- session changelog dc0-deploy-stepB, ruling record).
  default = "/var/lib/libvirt/vr1-dc0-inner/opnsense-26.7-nano.qcow2"
}

variable "domain_suffix" {
  description = "DNS domain suffix for the planes (mirrors the outer root)."
  type        = string
}

variable "underlay_mtu" {
  description = "Jumbo MTU for the internal fabric planes/mesh (9000). The site-wan uplink stays 1500."
  type        = number
}

variable "vr1_dc0_planes" {
  description = "The six vr1-dc0 planes (CIDR map), copied from the outer root's var of the same name -- the D-101 layout, unchanged. dc-planes creates them as isolated-L2 networks inside vvr1-dc0."
  type        = any
}