#!/usr/bin/env bash
# scripts/lib-identity.sh -- the cloud's NAME and DNS base, in ONE place.
#
# WHY THIS FILE EXISTS (2026-07-30, operator-directed). This is a rehearsal estate that is
# torn down and rebuilt repeatedly, and the region and DC names change every time. Operator,
# verbatim: "The specific server and region names do not matter as they change during every
# deployment and hardening of the deployment workflow." A naming surface that has to be
# hand-edited in several files on every rebuild is a defect generator -- F9 is the proof: the
# Octavia controller certificates on BOTH DCs carried a PREVIOUS deployment's region for weeks
# because the identity was TYPED into a runbook heredoc instead of derived.
#
# WHAT IS DERIVED vs WHAT LIVES HERE. After the 2026-07-30 work the naming chain is:
#
#     <service>.<cloud>.<dc>.<region>.<base domain>          (D-008 shape)
#                 |      |     |         |
#                 |      |     |         +-- CLOUD_DOMAIN, below
#                 |      |     +------------ DERIVED: ${SITE%%-*}   (vr1-dc0 -> vr1)
#                 |      +------------------ DERIVED: ${SITE#*-}    (vr1-dc0 -> dc0)
#                 +------------------------- CLOUD_NAME, below
#
# So region and DC follow the site token automatically and need no edit on a rebuild; these
# two constants are the ONLY typed identity left in the shell surface. Change them here and
# the certificates, DNS zones, SANs and the P7 preflight gate all follow.
#
# DELIBERATELY NOT IN lib-net.sh. Sourcing lib-net.sh bare POPULATES a full set of flat
# plane/VIP defaults (its own header: "sourcing this file with no further action continues to
# populate PLANE_CIDRS ... VR0/DC0's real, measured values"). A certificate checker needs two
# strings, not a network namespace, and pulling that namespace in would hand it a pile of
# values it never asked for -- the R9 hazard in miniature. This file has NO side effects
# beyond the two assignments, so it is safe to source from anywhere.
#
# ENV-OVERRIDABLE, and that is load-bearing rather than a convenience: it is what lets the
# harness prove the centralisation is REAL by changing the value and watching the derived
# zone change with it. A constant nothing can vary is indistinguishable from a literal.
#
# NOT the site allowlists. `vr1-dc0|vr1-dc1` stays an explicit token set in the selectors --
# an allowlist that accepts anything is how a typo'd DC name becomes a wrong-target write,
# which is exactly what preflight.sh and lib-net.sh refuse today.
#
# KEEP IN STEP WITH OPENTOFU. `opentofu/variables.tf` carries its own `domain_suffix` default
# because HCL cannot source a shell file. The two MUST agree; the octavia-pki harness asserts
# it, so a change here that forgets the tofu side turns the gauntlet red instead of silently
# splitting the estate's DNS in two.
#
# ASCII + LF. No side effects. Safe under `set -u`.

CLOUD_NAME="${CLOUD_NAME:-omega}"
CLOUD_DOMAIN="${CLOUD_DOMAIN:-cloud.neumatrix.local}"