# Module: `control-plane`

Provisions the **control-plane baseline host** (API + MySQL + Redis), doc/04 §5.2.

Key properties:

- Deployed on a **stable cloud unrelated to the data-plane node vendors**. Nodes
  can all be destroyed without affecting the control plane, and vice-versa. The
  control plane carries **no proxy traffic**.
- `prevent_destroy = true` — it holds the user DB; it is never recreated
  implicitly. Application bring-up (containers, migrations) is done by the server
  deploy pipeline, not Terraform.
- Admin/SSH surface is **never on the open internet** (doc/06 §2): inbound is
  locked to `allowlist_cidrs`; the public API sits behind a CDN/proxy terminated
  elsewhere.

Disabled by default in the root module (`control_plane_enabled = false`) because
it changes rarely.

## Inputs

| name | description |
|------|-------------|
| `server_type` / `location` / `image` | host sizing |
| `ssh_key_ids` | authorised SSH keys |
| `allowlist_cidrs` | admin/SSH inbound allowlist (tighten in prod) |

## Outputs

`ipv4_address`, `server_id`.