variable "env" {
  type        = string
  default     = "dev"
  description = "The environment name, e.g., dev, staging, prod"
}

variable "aws_region" {
  type        = string
  description = "The AWS region to deploy in, e.g., ap-east-1"
}

variable "logical_region_name" {
  type        = string
  description = "The TiDBCloud logical region name. Multiple logical regions can share one cloud region."
}

variable "availability_zones" {
  type        = list(string)
  description = "List of exactly 2 availability zone names, e.g., [\"ap-east-1a\", \"ap-east-1b\"]. The worker node group is placed in availability_zones[0]."

  validation {
    condition     = length(var.availability_zones) == 2
    error_message = "You must specify exactly 2 availability zones."
  }
}

variable "vpc_cidr" {
  type        = string
  default     = "10.1.0.0/16"
  description = "CIDR block for the VPC"

  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "vpc_cidr must be a valid CIDR block."
  }
}

variable "eks_version" {
  type        = string
  default     = "1.35"
  description = "Kubernetes version of the EKS cluster"
}

# Worker node group scaling
variable "worker_instance_type" {
  type        = string
  default     = "r6a.xlarge"
  description = "Instance type for the worker node group"
}

variable "worker_desired_size" {
  type        = number
  default     = 3
  description = "Desired number of nodes in the worker node group"
}

variable "worker_min_size" {
  type        = number
  default     = 1
  description = "Minimum number of nodes in the worker node group"
}

variable "worker_max_size" {
  type        = number
  default     = 10
  description = "Maximum number of nodes in the worker node group"
}

variable "worker_max_pods_per_node" {
  type        = number
  default     = 110
  description = "Kubelet maxPods for worker nodes (requires prefix delegation on vpc-cni)"
}

# RDS
variable "enable_rds" {
  type        = bool
  default     = false
  description = "Whether to provision the kubestore RDS MySQL instance for the regional server"
}

variable "rds_instance_class" {
  type        = string
  default     = "db.t4g.large"
  description = "RDS instance class"
}

variable "rds_deletion_protection" {
  type        = bool
  default     = false
  description = "Enable RDS deletion protection. Must be false for terraform destroy to remove the DB instance."
}

# Account / SNS overrides
# By default both are resolved from the aws/o11y-global/{env}.json remote state.
# Dev has no o11y-global state (the o11y-global module only supports
# staging/prod), so for dev both must be provided explicitly — which also skips
# the state read entirely.
variable "o11y_account" {
  type        = string
  default     = ""
  description = "O11y control-plane AWS account ID override. When empty, resolved from the aws/o11y-global remote state."

  validation {
    condition     = var.o11y_account == "" || var.sns_topic_arn != ""
    error_message = "sns_topic_arn must be set when o11y_account is overridden (the o11y-global state read is skipped)."
  }
}

variable "sns_topic_arn" {
  type        = string
  default     = ""
  description = "DMS alert SNS topic ARN override. When empty, resolved from the aws/o11y-global remote state."
}

# S3 bucket policy
variable "elb_account_id" {
  type        = string
  default     = null
  description = "Regional ELB account ID granted s3:PutObject on the ds-logs bucket (legacy NLB/ALB access-log delivery). When null the statement is omitted."
}

# VPC endpoint service
variable "nlb_allowed_principals" {
  type = list(string)
  default = [
    "arn:aws:iam::143458967504:root",
    "arn:aws:iam::730335266318:root",
    "arn:aws:iam::380838443567:root",
    "arn:aws:iam::385595570414:root",
  ]
  description = "IAM principals allowed to create interface endpoints to the prometheus VPC endpoint service"
}

# DNS overrides (empty = derive from env/logical region name)
variable "hosted_zone_name" {
  type        = string
  default     = ""
  description = "Route53 hosted zone name override. Defaults to observability.tidbcloud.com (prod) or observability-<env>.pingcap.cloud"
}

variable "rs_domain_name" {
  type        = string
  default     = ""
  description = "Regional server domain override. Defaults to www.rs.<logical>.aws.<hosted_zone_name>"
}

variable "ds_domain_name" {
  type        = string
  default     = ""
  description = "Data server domain override. Defaults to www.ds.<logical>.aws.<hosted_zone_name>"
}

variable "use_pca" {
  type        = bool
  default     = false
  description = "Issue rs/ds certificates from the account Private CA (read from aws/base state) instead of public ACM certs with DNS validation"
}

# EKS access entries
variable "admin_role_names" {
  type        = list(string)
  default     = ["cicd-role", "autonomous-oncall"]
  description = "IAM role names in the o11y account granted AmazonEKSClusterAdminPolicy"
}

variable "jump_service_account_role_arn" {
  type        = string
  default     = "arn:aws:iam::557537366020:role/jump-service-role"
  description = "Cross-account jump-service role granted AmazonEKSClusterAdminPolicy via an EKS access entry"
}

variable "jump_server_role_arn" {
  type        = string
  default     = ""
  description = "assumeRole used by the jumpserver destination. Defaults to arn:aws:iam::<o11y_account>:role/jump-service-role"
}

variable "tags" {
  type        = map(string)
  default     = {}
  description = "Tags to apply to all resources"
}