# =====================================================================
# D-123 MODEL B (2026-07-16) -- vr1-dc0 INNER SUBSTRATE, created inside vvr1-dc0.
# Run this root AFTER: (1) the outer opentofu/ root has booted + sized vvr1-dc0
# (expose_nested_virt=true), and (2) the bootstrap gate (site-headend-install.sh
# node-host mode) has installed libvirtd + the inner pool + kvm nested=1 + the
# OPNsense base image on vvr1-dc0. The provider dials vvr1-dc0 over the D-124 transit
# (R-5: remote qemu+ssh from Office1). All module bodies are UNCHANGED from the outer
# root -- only the provider they run against moved (vcloud -> vvr1-dc0). See
# docs/model-a-fallback-plan.md for the Model A revert.
# =====================================================================

provider "libvirt" {
  # qemu+ssh to vvr1-dc0 over the transit. Key auth + known_hosts verified out of band
  # (NO no_verify). The IP is MEASURED after the outer apply (hard rule 2).
  uri = "qemu+ssh://${var.vvr1_dc0_ssh_user}@${var.vvr1_dc0_transit_ip}/system"
}

# Inner storage pool (backs the node + edge disks) -- created inside vvr1-dc0 at the
# path the bootstrap step provisioned.
module "inner_storage" {
  source      = "../modules/dc-storage-pool"
  dc_name     = "vr1-dc0-inner"
  target_path = var.inner_pool_path
}

# The six vr1-dc0 planes (D-101 layout, unchanged) -- now isolated-L2 networks INSIDE
# vvr1-dc0. metal-admin is where the rack serves PXE/DHCP to the inner nodes.
module "vr1_dc0_planes" {
  source        = "../modules/dc-planes"
  dc_name       = "vr1-dc0"
  domain_suffix = var.domain_suffix
  mtu           = var.underlay_mtu
  planes        = var.vr1_dc0_planes
}

# D-122: the dedicated per-site simulated-ISP uplink (172.30.2.0/24, D-115).
module "vr1_dc0_wan" {
  source       = "../modules/site-wan"
  network_name = "vr1-dc0-wan"
  cidr         = "172.30.2.0/24"
  # mtu defaults to 1500 (ISP-uplink domain; NOT the jumbo planes/mesh).
}

# D-122: the DC edge -- 2-NIC (WAN + LAN), Office1 pattern (2048/2/nano). LAN =
# provider-public (external gateway, D-100); WAN = the dedicated uplink above.
module "vr1_dc0_opnsense" {
  source           = "../modules/opnsense-edge"
  vm_name          = "vr1-dc0-opnsense"
  memory_mib       = 2048
  vcpu             = 2
  pool_name        = module.inner_storage.pool_name
  base_volume_path = var.opnsense_base_path
  lan_network_name = module.vr1_dc0_planes.network_names["provider-public"]
  wan_network_name = module.vr1_dc0_wan.network_name
}

# D-121 Option C layout (R-3 2026-07-16): 3 control + 2 compute + 4 storage = 9 nodes/DC.
# Six NICs each (one per plane); metal-admin FIRST = PXE/boot plane (D-052 default binding).
locals {
  vr1_dc0_node_nics = [
    module.vr1_dc0_planes.network_names["metal-admin"], # PXE / boot fabric first
    module.vr1_dc0_planes.network_names["provider-public"],
    module.vr1_dc0_planes.network_names["metal-internal"],
    module.vr1_dc0_planes.network_names["data-tenant"],
    module.vr1_dc0_planes.network_names["storage"],
    module.vr1_dc0_planes.network_names["replication"],
  ]

  vr1_dc0_nodes = {
    "vr1-dc0-control-01" = { vcpu = 16, mem = 65536, disk_gib = 150 }
    "vr1-dc0-control-02" = { vcpu = 16, mem = 65536, disk_gib = 150 }
    "vr1-dc0-control-03" = { vcpu = 16, mem = 65536, disk_gib = 150 }
    "vr1-dc0-compute-01" = { vcpu = 12, mem = 49152, disk_gib = 100 }
    "vr1-dc0-compute-02" = { vcpu = 12, mem = 49152, disk_gib = 100 }
    "vr1-dc0-storage-01" = { vcpu = 8, mem = 24576, disk_gib = 550 }
    "vr1-dc0-storage-02" = { vcpu = 8, mem = 24576, disk_gib = 550 }
    "vr1-dc0-storage-03" = { vcpu = 8, mem = 24576, disk_gib = 550 }
    "vr1-dc0-storage-04" = { vcpu = 8, mem = 24576, disk_gib = 550 } # R-3: 4th OSD host
  }
}

module "vr1_dc0_node" {
  for_each = local.vr1_dc0_nodes

  source          = "../modules/node-vm"
  vm_name         = each.key
  vcpu            = each.value.vcpu
  memory_mib      = each.value.mem
  disk_size_bytes = each.value.disk_gib * 1024 * 1024 * 1024
  pool_name       = module.inner_storage.pool_name
  network_names   = local.vr1_dc0_node_nics
}