# Copy to terraform.tfvars (gitignored) and fill in. NEVER commit real values.
# hcloud_token is injected via TF_VAR_hcloud_token in CI instead of this file.

# hcloud_token = "REDACTED — inject via TF_VAR_hcloud_token"

ssh_public_keys = [
  # "ssh-ed25519 AAAA... pangolin-mgmt"
]

probe_overseas = {
  eu = { location = "hel1", server_type = "cpx11" }
  us = { location = "ash", server_type = "cpx11" }
}

control_plane_enabled = false
admin_allowlist_cidrs = [
  # "203.0.113.10/32"  # management bastion only — admin never on public internet
]