provider "hcloud" {
  token = var.hcloud_token
}

# SSH keys for the management identity (probe + control-plane access).
resource "hcloud_ssh_key" "mgmt" {
  for_each   = { for idx, key in var.ssh_public_keys : idx => key }
  name       = "pangolin-mgmt-${each.key}"
  public_key = each.value
}

locals {
  ssh_key_ids = [for k in hcloud_ssh_key.mgmt : k.id]
}

# Overseas reference probe points (low frequency → Terraform-managed).
# 境内 probe points are serverless / third-party dialing services with strict
# identity isolation and are intentionally OUT of Terraform scope (registered in
# ../identity-isolation.md).
module "probe" {
  source   = "./modules/probe"
  for_each = var.probe_overseas

  name        = each.key
  location    = each.value.location
  server_type = each.value.server_type
  image       = var.probe_image
  ssh_key_ids = local.ssh_key_ids
}

# Control-plane baseline env (API + MySQL + Redis), provisioned once and rarely
# changed. Disabled by default; flip control_plane_enabled to manage it here.
module "control_plane" {
  source = "./modules/control-plane"
  count  = var.control_plane_enabled ? 1 : 0

  server_type    = var.control_plane_server_type
  location       = var.control_plane_location
  image          = var.probe_image
  ssh_key_ids    = local.ssh_key_ids
  allowlist_cidrs = var.admin_allowlist_cidrs
}