variable "vm_name" {
  description = "Domain name, e.g. \"office1-opnsense\", \"dc1-opnsense\"."
  type        = string
}

variable "memory_mib" {
  description = "Memory in MiB. No default -- pass explicitly (OPNsense sizing hasn't been decided; check OPNsense's own hardware-sizing guidance for the expected role before picking a value)."
  type        = number
}

variable "vcpu" {
  description = "Virtual CPU count. No default -- pass explicitly."
  type        = number
}

variable "pool_name" {
  description = "libvirt_pool this VM's disk + config-seed volume live in."
  type        = string
}

variable "disk_size_bytes" {
  description = "Boot disk size in bytes (the backing_store overlay's capacity, not the base nano image's own size). No default -- pass explicitly."
  type        = number
}

variable "base_volume_path" {
  description = <<-EOT
    Host filesystem path of the PREPARED (decompressed, qcow2-converted,
    resized) OPNsense nano image -- the output of
    `scripts/opnsense-prep-image.sh`, typically fed through a
    `modules/base-image` call (pass that module's `path` output here; the
    same real-attribute-reference pattern modules/cloudinit-vm uses). Do NOT
    point this at the raw downloaded .img.bz2 -- libvirt_volume's
    create.content.url almost certainly does a plain fetch with no
    decompression/conversion; that work must already be done.
  EOT
  type = string
}

variable "config_iso_path" {
  description = <<-EOT
    Host filesystem path of a plain ISO9660 image containing
    /conf/config.xml -- the output of
    `scripts/opnsense-build-config-iso.sh`. This is OPNsense's own
    Configuration Importer mechanism (NOT cloud-init -- confirmed unreliable
    on OPNsense/FreeBSD; see opentofu/README.md's OPNsense research section).
    No default: the real config.xml content for this site's LAN/WAN/routing
    role is design work that has to happen first -- do not point this at a
    placeholder/empty config.xml to make the module "work" sooner.
  EOT
  type = string
}

variable "lan_network_name" {
  description = <<-EOT
    libvirt_network name intended to become this edge's LAN side -- placed
    at interfaces[0] in main.tf, which plausibly (not guaranteed) determines
    which vtnetN device FreeBSD assigns it. IMPORTANT (corrected 2026-07-09
    audit): this variable does NOT by itself make OPNsense treat it as LAN --
    that role assignment happens separately, inside config.xml's own
    interface-to-role mapping (or the interactive/API assignment step).
    "vtnet0 = WAN" is a convention some guides use, not an enforced rule.
    Confirm the real vtnetN<->network mapping on a real boot (e.g. `ifconfig`)
    before writing config.xml's <wan>/<lan> interface names -- do not assume
    "passed as lan_network_name" automatically becomes OPNsense's LAN role.
    Kept as an explicit named variable (not an ordered list) so the INTENT
    stays clear in this file even though the real role still comes from
    config.xml.
  EOT
  type = string
}

variable "wan_network_name" {
  description = <<-EOT
    libvirt_network name intended to become this edge's WAN side -- placed at
    interfaces[1] in main.tf. Same caveat as lan_network_name: this ordering
    does not itself assign the WAN role in OPNsense; config.xml does. The
    mesh-link legs (modules/mesh-link) or a per-site ISP-simulated segment
    are the expected callers here.
  EOT
  type = string
}