variables.tf

variable "dtc-description" {
  type        = string
  description = "Description of the datacenter."
  default     = ""
}

variable "ui-language" {
  type        = string
  description = "Language for the PVE user interface."
  default     = "en"
  validation {
    condition     = can(regex("^(ca|da|de|en|es|eu|fa|fr|he|it|ja|nb|nn|pl|pt_BR|ru|sl|sv|tr|zh_CN|zh_TW)$", var.ui-language))
    error_message = "Proxmox VE ui currently supports only the following languages: ca, da, de, en, es, eu, fa, fr, he, it, ja, nb, nn, pl, pt_BR, ru, sl, sv, tr, zh_CN, zh_TW!"
  }
}

variable "vnc-kb-layout" {
  type        = string
  description = "Keyboard layout for vnc server."
  default     = "en-us"
  validation {
    condition     = can(regex("^(de|de-ch|da|en-gb|en-us|es|fi|fr|fr-be|fr-ca|fr-ch|hu|is|it|ja|lt|mk|nl|no|pl|pt|pt-br|sv|sl|tr)$", var.vnc-kb-layout))
    error_message = "Proxmox VE vnc server currently supports only the following keyboard layouts: de, de-ch, da, en-gb, en-us, es, fi, fr, fr-be, fr-ca, fr-ch, hu, is, it, ja, lt, mk, nl, no, pl, pt, pt-br, sv, sl, tr"
  }
}

variable "http-proxy" {
  type        = string
  description = "HTTP proxy to be used for downloads. (e.g. 'http://username:password@host:port/')"
  default     = null
}

variable "dtc-console-viewer" {
  type        = string
  description = "Default console viewer."
  default     = "xtermjs"
  validation {
    condition     = can(regex("^(applet|vv|html5|xtermjs)$", var.dtc-console-viewer))
    error_message = "Proxmox VE currently supports only the following console viewers: applet, vv, html5, xtermjs!"
  }
}

variable "dtc-email" {
  type        = string
  description = "Email address to send notifications from the datacenter."
  default     = null
}

variable "dtc-mac-prefix" {
  type        = string
  description = "Prefix for autogenerated MAC addresses of virtual guests."
  default     = "BC:24:11"
}

variable "dtc-migration-type" {
  type        = string
  description = "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance."
  default     = "secure"
  validation {
    condition     = can(regex("^(secure|insecure)$", var.dtc-migration-type))
    error_message = "Migration type can be either secure or insecure!"
  }
}

variable "dtc-migration-cidr" {
  type        = string
  description = "CIDR range for migration traffic."
  default     = null

}

variable "dtc-ha-policy" {
  type        = string
  description = "Describes the policy for handling HA services on poweroff or reboot of a node."
  default     = "conditional"
  validation {
    condition     = can(regex("^(conditional|failover|freeze|migrate)$", var.dtc-ha-policy))
    error_message = "HA policy can be either conditional, failover, freeze or migrate!"
  }
}

variable "dtc-crs" {
  type = object({
    ha           = string
    ha-rebalance = bool
  })
  description = "Cluster resource scheduling settings."
  default = {
    ha           = "basic"
    ha-rebalance = false
  }
}

variable "dtc-bw-limits" {
  type = object({
    default   = optional(number)
    restore   = optional(number)
    migration = optional(number)
    clone     = optional(number)
    move      = optional(number)
  })
  description = "Set I/O bandwidth limit for various operations (in KiB/s)."
  default     = {}
}

variable "dtc-max-workers" {
  type        = number
  description = "Defines how many workers (per node) are maximal started on actions like stopall VMs or task from the ha-manager."
  default     = 5
}

variable "dtc-vmid-range" {
  type = object({
    lower = number
    upper = number
  })
  description = "Control the range for the free VMID auto-selection pool."
  default = {
    lower = 1000
    upper = 1000000
  }
}

variable "dtc-fw-enabled" {
  type        = bool
  description = "Enable firewall at datacenter level."
  default     = true
}

variable "dtc-fw-ebtables" {
  type        = bool
  description = "Enable ebtables at datacenter level."
  default     = true
}

variable "dtc-fw-inpol" {
  type        = string
  description = "Datacenter level firewall input policy."
  default     = "DROP"
}

variable "dtc-fw-outpol" {
  type        = string
  description = "Datacenter level firewall output policy."
  default     = "ACCEPT"
}

variable "dtc-fw-lrl" {
  type = object({
    enabled = optional(bool)
    burst   = optional(number)
    rate    = optional(string)
  })
  description = "Datacenter level fw log rate limit configuration."
  default = {
    enabled = false
  }
}

variable "dtc-fsg" {
  type = map(object({
    comment = optional(string)
    rules = list(object({
      enabled   = optional(bool)
      iface     = optional(string)
      action    = string
      direction = string
      sourceip  = optional(string)
      destip    = optional(string)
      sport     = optional(string)
      dport     = optional(string)
      proto     = optional(string)
      log       = optional(string)
      comment   = optional(string)
    }))
  }))
  description = "Datacenter level firewall security groups."
  default     = {}
}

variable "dtc-fw-rules" {
  type = map(object({
    enabled   = optional(bool)
    iface     = optional(string)
    action    = string
    direction = string
    sourceip  = optional(string)
    destip    = optional(string)
    sport     = optional(string)
    dport     = optional(string)
    proto     = optional(string)
    log       = optional(string)
    comment   = optional(string)
  }))
  description = "Datacenter level firewall rules."
  default     = {}
}

variable "dtc-fw-fsg" {
  type = map(object({
    enabled = optional(bool)
    fsg     = string
    iface   = optional(string)
    comment = optional(string)
  }))
  description = "Datacenter level firewall rules that import from a security group."
  default     = {}
}

variable "dtc-pools" {
  type        = map(string)
  description = "Pools for resources."
  default     = {}
}

variable "node-name" {
  type        = string
  description = "Name of the Proxmox VE node."
  default     = null
}

variable "node-timezone" {
  type        = string
  description = "Timezone of the Proxmox VE node."
  default     = "UTC"
}

variable "node-dns" {
  type = object({
    search-domain = string
    servers       = optional(list(string))
  })
  description = "PVE node DNS settings."
  default     = null
}

variable "node-hosts-entries" {
  type = map(object({
    address   = string
    hostnames = list(string)
  }))
  description = "PVE node /etc/hosts entries."
  default     = {}
}

variable "node-bridges" {
  type = map(object({
    autostart     = optional(bool)
    comment       = optional(string)
    ipv4-cidr     = optional(string)
    ipv4-gw       = optional(string)
    ipv6-cidr     = optional(string)
    ipv6-gw       = optional(string)
    mtu           = optional(number)
    bridged-ports = optional(list(string))
    vlan_aware    = optional(bool)
  }))
  description = "PVE node Linux network bridges."
  default     = {}
}

variable "run-bootstrap" {
  type        = bool
  description = "Run bootstrap script on PVE node to configure settings missing (as of yet) in the provider."
  default     = false
}

variable "node-ip" {
  type        = string
  description = "IP address of the Proxmox VE node."
  validation {
    condition     = var.node-ip == null || can(regex("^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$", var.node-ip))
    error_message = "Invalid IP address!"
  }
  nullable = true
  default  = null
}

variable "node-ssh-user" {
  type        = string
  description = "Username for the Proxmox VE node ssh connection."
  default     = null
}

variable "node-ssh-pw" {
  type        = string
  description = "Password for the Proxmox VE node ssh connection."
  default     = null
}

variable "node-ssh-privkey" {
  type        = string
  description = "Private key for the Proxmox VE node ssh connection."
  default     = null
}

variable "dtc-tag" {
  type = object({
    case  = optional(number)
    order = optional(string)
    shape = optional(string)
  })
  description = "[case=<1|0>], [order=<config|alphabetical>], [shape=full|circle|dense|none]"
  default = {
    order = "config"
  }
}

variable "node-fw-enabled" {
  type        = bool
  description = "Enable firewall at node level."
  default     = true
}

variable "node-fw-log-in" {
  type        = string
  description = "Log level for incoming packets."
  default     = "nolog"
  validation {
    condition     = can(regex("^(emerg|alert|crit|err|warning|notice|info|debug|nolog)$", var.node-fw-log-in))
    error_message = "Log level can be one of: emerg, alert, crit, err, warning, notice, info, debug, nolog!"
  }
}

variable "node-fw-log-out" {
  type        = string
  description = "Log level for outgoing packets."
  default     = "nolog"
  validation {
    condition     = can(regex("^(emerg|alert|crit|err|warning|notice|info|debug|nolog)$", var.node-fw-log-out))
    error_message = "Log level can be one of: emerg, alert, crit, err, warning, notice, info, debug, nolog!"
  }
}

variable "node-fw-smurfs" {
  type        = bool
  description = "Enable SMURFS protection at node level."
  default     = true
}

variable "node-fw-smurfs-log" {
  type        = string
  description = "Log level for SMURFS packets."
  default     = "nolog"
  validation {
    condition     = can(regex("^(emerg|alert|crit|err|warning|notice|info|debug|nolog)$", var.node-fw-smurfs-log))
    error_message = "Log level can be one of: emerg, alert, crit, err, warning, notice, info, debug, nolog!"
  }

}

variable "node-fw-tcpflags" {
  type        = bool
  description = "Enable TCP flags filtering at node level."
  default     = false
}

variable "node-fw-tcpflags-log" {
  type        = string
  description = "Log level for TCP flags packets."
  default     = "nolog"
  validation {
    condition     = can(regex("^(emerg|alert|crit|err|warning|notice|info|debug|nolog)$", var.node-fw-tcpflags-log))
    error_message = "Log level can be one of: emerg, alert, crit, err, warning, notice, info, debug, nolog!"
  }

}

variable "node-fw-ndp" {
  type        = bool
  description = "Enable NDP filtering at node level."
  default     = false
}