variable "hcloud_token" {
  description = "Hetzner Cloud API token for the PROBE/management account ONLY (independent identity; never the data-plane vendor accounts). Inject via TF_VAR_hcloud_token / CI secret, never commit."
  type        = string
  sensitive   = true
}

variable "ssh_public_keys" {
  description = "SSH public keys authorised on probe machines (management identity)."
  type        = list(string)
  default     = []
}

variable "probe_overseas" {
  description = "Overseas reference probe points (doc/04 §4.2). Each emits a probe machine."
  type = map(object({
    location    = string # vendor location, e.g. "hel1", "ash"
    server_type = string # e.g. "cpx11"
  }))
  default = {
    eu = { location = "hel1", server_type = "cpx11" }
    us = { location = "ash", server_type = "cpx11" }
  }
}

variable "probe_image" {
  description = "OS image for probe machines."
  type        = string
  default     = "debian-12"
}

variable "control_plane_enabled" {
  description = "Whether to manage the control-plane baseline env in this state. Off by default — the control plane is provisioned once and rarely changes."
  type        = bool
  default     = false
}

variable "control_plane_server_type" {
  description = "Server type for the control-plane host (API + MySQL + Redis), if managed here."
  type        = string
  default     = "cpx21"
}

variable "control_plane_location" {
  description = "Location for the control-plane host."
  type        = string
  default     = "hel1"
}

variable "admin_allowlist_cidrs" {
  description = "CIDRs allowed to reach the admin/SSH surface of the control plane (doc/06 §2: admin never on public internet)."
  type        = list(string)
  default     = []
}