variables.tf

################################################################################
# modules/reference-stack: variables
#
# Simplified variable surface for the six deployment profiles. Variables are
# grouped by concern; each group documents which leaf module consumes it.
################################################################################

################################################################################
# Core identity
################################################################################

variable "deployment_name" {
  description = <<-EOT
    Name of this Poolside deployment. Used as the basis for naming every AWS
    resource (EKS cluster, RDS instance, S3 buckets, IAM roles, etc.).
    Must be lowercase alphanumeric with optional hyphens.
  EOT
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9]([a-z0-9-]*[a-z0-9])?$", var.deployment_name))
    error_message = "deployment_name must be lowercase alphanumeric with optional hyphens, and may not start or end with a hyphen."
  }

  # AWS caps ALB names at 32 chars. The poolside-values module uses
  # `poolside-<deployment_name>` for the alb.ingress.kubernetes.io/
  # load-balancer-name annotation, so the prefix consumes 9 chars and
  # leaves 23 for deployment_name. Failing at plan time beats failing
  # 25 minutes into apply when the LBC rejects the ingress.
  validation {
    condition     = length(var.deployment_name) <= 23
    error_message = "deployment_name must be ≤23 characters: it's used as a suffix on the ALB name (`poolside-<deployment_name>`), and AWS caps ALB names at 32 chars."
  }
}

variable "region" {
  description = "AWS region for all resources."
  type        = string
}

variable "tags" {
  description = "Tags applied to every resource. Merged with automatic managed-by and deployment-name tags."
  type        = map(string)
  default     = {}
}

################################################################################
# Deployment profile flags
################################################################################

variable "enable_gpu_node_group" {
  description = <<-EOT
    Whether to create a GPU node group for local model inference. Set true for
    the full profile. When true, the gpu-operator module is
    also installed.
  EOT
  type        = bool
  default     = false
}

variable "enable_cognito" {
  description = <<-EOT
    Whether to create an AWS Cognito user pool for authentication. Default
    false — most deployments bring their own OIDC provider. When true,
    var.public_hostname must be set.
  EOT
  type        = bool
  default     = false
}

################################################################################
# Network
################################################################################

variable "vpc_cidr" {
  description = "CIDR block for the VPC. Default /21 supports up to 4 AZs with the reference architecture subnet layout."
  type        = string
  default     = "10.0.0.0/21"
}

variable "availability_zones" {
  description = "AZ letters to use (e.g. [\"a\", \"b\"]). 2-4 zones supported."
  type        = list(string)
  default     = ["a", "b"]
}

variable "single_nat_gateway" {
  description = "Use a single shared NAT gateway instead of one per AZ. Saves cost but removes AZ-level NAT redundancy."
  type        = bool
  default     = false
}

################################################################################
# EKS cluster
################################################################################

variable "kubernetes_version" {
  description = "Kubernetes minor version for the EKS cluster (e.g. \"1.32\")."
  type        = string
  default     = "1.32"
}

variable "eks_support_type" {
  description = "EKS support type: \"STANDARD\" (default, no extra cost) or \"EXTENDED\" (paid, extends support window)."
  type        = string
  default     = "STANDARD"
}

variable "cluster_endpoint_public_access" {
  description = "Whether the EKS public API endpoint is enabled."
  type        = bool
  default     = true
}

variable "cluster_endpoint_public_access_cidrs" {
  description = "CIDR blocks allowed to reach the EKS public API endpoint. No default — must be explicitly set."
  type        = list(string)
}

variable "admin_principal_arns" {
  description = "AWS principal ARNs that get cluster-admin access via EKS Access Entries."
  type        = list(string)
}

variable "allow_locked_out_cluster" {
  description = "When false (default), validates that the running principal is in admin_principal_arns to prevent lockout."
  type        = bool
  default     = false
}

################################################################################
# CPU node group
################################################################################

variable "cpu_instance_type" {
  description = "EC2 instance type for the CPU node group."
  type        = string
  default     = "m5.4xlarge"
}

variable "cpu_min_size" {
  description = "Minimum number of CPU nodes."
  type        = number
  default     = 1
}

variable "cpu_max_size" {
  description = "Maximum number of CPU nodes."
  type        = number
  default     = 10
}

variable "cpu_desired_size" {
  description = "Initial desired number of CPU nodes."
  type        = number
  default     = 3
}

variable "cpu_ebs_volume_size_gib" {
  description = "Root EBS volume size (GiB) for CPU nodes."
  type        = number
  default     = 200
}

variable "cpu_ami_type" {
  description = <<-EOT
    EKS-managed AMI type for the CPU node group. Default
    `AL2023_x86_64_STANDARD` is the AL2023 EKS-optimized image. Other valid
    values include `AL2023_ARM_64_STANDARD` (Graviton),
    `BOTTLEROCKET_x86_64`, `BOTTLEROCKET_ARM_64`. If you set
    `cpu_custom_ami_id`, this must match a value compatible with your AMI.
  EOT
  type        = string
  default     = "AL2023_x86_64_STANDARD"
}

variable "cpu_ami_release_version" {
  description = <<-EOT
    Specific AL2023 EKS-optimized AMI release version to pin for the CPU
    node group (e.g. "1.32.0-20251120"). Default null = AWS-managed latest
    for the cluster's Kubernetes version. Pin to avoid surprise AMI
    rotations during operations windows.
  EOT
  type        = string
  default     = null
}

variable "cpu_custom_ami_id" {
  description = <<-EOT
    Bring-your-own AMI ID for the CPU node group. When set, AWS-managed
    AMI updates are disabled — you own AMI lifecycle, EKS compatibility
    (kubelet, containerd, CNI, SSM agent), and any custom-CA injection.
    When set, `cpu_custom_user_data` MUST also be set (empty string is
    allowed if your AMI self-bootstraps).
  EOT
  type        = string
  default     = null
}

variable "cpu_custom_user_data" {
  description = <<-EOT
    Raw cloud-init user data injected into the CPU node group's launch
    template. REQUIRED when `cpu_custom_ami_id` is set; ignored otherwise.
    Pass empty string "" if your custom AMI self-bootstraps (rare). When
    `cpu_custom_ami_id` is null, the AWS-managed AMI's nodeadm bootstrap
    is used and this is ignored.
  EOT
  type        = string
  default     = null
}

################################################################################
# GPU node group (only when enable_gpu_node_group = true)
################################################################################

variable "gpu_instance_type" {
  description = "EC2 instance type for the GPU node group."
  type        = string
  default     = "p5e.48xlarge"
}

variable "gpu_min_size" {
  description = "Minimum number of GPU nodes. Default 0 (scale from zero)."
  type        = number
  default     = 0
}

variable "gpu_max_size" {
  description = "Maximum number of GPU nodes."
  type        = number
  default     = 2
}

variable "gpu_desired_size" {
  description = "Initial desired number of GPU nodes."
  type        = number
  default     = 0
}

variable "gpu_ebs_volume_size_gib" {
  description = "Root EBS volume size (GiB) for GPU nodes."
  type        = number
  default     = 200
}

variable "gpu_ami_type" {
  description = <<-EOT
    EKS-managed AMI type for the GPU node group. Default
    `AL2023_x86_64_NVIDIA` is the AL2023 EKS-optimized image with NVIDIA
    drivers and container toolkit pre-installed. If you set
    `gpu_custom_ami_id`, this must match a value compatible with your AMI.
  EOT
  type        = string
  default     = "AL2023_x86_64_NVIDIA"
}

variable "gpu_ami_release_version" {
  description = <<-EOT
    Specific AL2023 NVIDIA EKS-optimized AMI release version to pin for
    the GPU node group. Default null = AWS-managed latest for the
    cluster's Kubernetes version. Pin to avoid surprise driver-version
    changes during operations windows.
  EOT
  type        = string
  default     = null
}

variable "gpu_custom_ami_id" {
  description = <<-EOT
    Bring-your-own AMI ID for the GPU node group. CRITICAL: a custom GPU
    AMI must include working NVIDIA drivers, nvidia-container-toolkit,
    and the runtime setup the device plugin expects. The AL2023 NVIDIA
    AMI ships all of this; a barebones custom AMI will boot but pods
    will fail to schedule because the GPUs aren't visible to the device
    plugin. When set, `gpu_custom_user_data` MUST also be set.
  EOT
  type        = string
  default     = null
}

variable "gpu_custom_user_data" {
  description = <<-EOT
    Raw cloud-init user data injected into the GPU node group's launch
    template. REQUIRED when `gpu_custom_ami_id` is set; ignored otherwise.
  EOT
  type        = string
  default     = null
}

variable "gpu_subnet_ids" {
  description = <<-EOT
    Subnet IDs for the GPU node group. Default null = use all private worker
    subnets (spans every AZ). Override to pin GPU nodes to specific AZ(s)
    where capacity reservations exist — without this, the node group may
    attempt to launch in an AZ that has no CR capacity and fail with
    InsufficientInstanceCapacity.

    Use the `private_worker_subnet_ids_by_az` output from reference-stack
    to select the right subnet(s):
      gpu_subnet_ids = [module.stack.private_worker_subnet_ids_by_az["us-east-2b"]]
  EOT
  type        = list(string)
  default     = null
}

variable "gpu_capacity_reservation_id" {
  description = <<-EOT
    EC2 capacity reservation ID to target for GPU instances. Optional.
    Verify the reservation has available capacity before applying:
      aws ec2 describe-capacity-reservations --capacity-reservation-ids <cr-id> \
        --query 'CapacityReservations[0].AvailableInstanceCount'
    Targeted reservations (InstanceMatchCriteria: targeted) must be explicitly
    referenced. Cross-account reservations shared via AWS RAM are supported.
  EOT
  type        = string
  default     = null
}

variable "gpu_capacity_reservation_resource_group_arn" {
  description = <<-EOT
    Capacity reservation resource group ARN for GPU instances. Optional.
    Alternative to gpu_capacity_reservation_id — use when capacity is
    managed via a resource group rather than a specific reservation.
    Verify available capacity before applying.
  EOT
  type        = string
  default     = null
}

variable "gpu_use_capacity_block" {
  description = "Enable EC2 Capacity Block for ML on the GPU node group."
  type        = bool
  default     = false
}

################################################################################
# Database (RDS PostgreSQL)
################################################################################

variable "database_instance_class" {
  description = "RDS instance class for the PostgreSQL database."
  type        = string
  default     = "db.m7g.xlarge"
}

variable "database_multi_az" {
  description = "Enable RDS multi-AZ with synchronous standby."
  type        = bool
  default     = true
}

variable "database_allocated_storage_gib" {
  description = "Initial allocated storage (GiB) for the RDS instance."
  type        = number
  default     = 64
}

variable "database_max_allocated_storage_gib" {
  description = "Maximum storage (GiB) for RDS storage auto-scaling."
  type        = number
  default     = 256
}

variable "database_deletion_protection" {
  description = "Enable RDS deletion protection. Set false for POC teardown."
  type        = bool
  default     = true
}

################################################################################
# Cognito (only when enable_cognito = true)
################################################################################

variable "public_hostname" {
  description = <<-EOT
    Public DNS hostname for the Poolside deployment (e.g.
    "poolside.example.com"). Required.

    The reference architecture terminates TLS at the ALB and is transitively coupled
    to a hostname: an ACM cert is bound to a hostname, and the ALB
    listener needs a cert. Cognito (when enabled) also uses this for
    callback/logout URLs. Must be a syntactically valid lowercase DNS
    hostname (dots + hyphens; no uppercase, underscores, or leading/
    trailing hyphens).
  EOT
  type        = string
  nullable    = false

  validation {
    condition     = can(regex("^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$", var.public_hostname))
    error_message = "public_hostname must be a valid lowercase DNS hostname with at least one dot (e.g. \"poolside.example.com\"). Uppercase, underscores, and leading/trailing hyphens are not permitted."
  }
}

################################################################################
# IAM
################################################################################

variable "iam_name_prefix" {
  description = <<-EOT
    Prefix prepended to every IAM role and policy name. For regulated
    environments (PubSec) where SCPs require specific naming. Empty string
    means no prefix.
  EOT
  type        = string
  default     = ""
}

variable "permissions_boundary_arn" {
  description = <<-EOT
    ARN of an IAM permissions boundary policy to attach to every IAM role the
    stack creates (node group roles, IRSA roles, and the EKS cluster role).
    Required by some regulated environments where SCPs mandate a boundary on
    all new roles. When empty (default), no boundary is attached.
  EOT
  type        = string
  default     = ""
}

################################################################################
# TLS / Custom CA
################################################################################

variable "custom_ca_bundle_pem" {
  description = <<-EOT
    PEM-encoded custom CA certificate chain to trust. When non-empty, a
    ConfigMap is created in the poolside namespace and mounted into all
    Poolside pods at /etc/ssl/certs/custom-ca-bundle.crt. Use this when
    the deployment environment has internal CAs (e.g. corporate proxy,
    private git servers, self-signed MCP server certs).

    Provide the full PEM chain (root + any intermediates) as a single
    string. Example:

      custom_ca_bundle_pem = file("path/to/ca-chain.pem")
  EOT
  type        = string
  default     = ""
}

################################################################################
# S3 / ECR lifecycle
################################################################################

variable "s3_force_destroy_buckets" {
  description = "Allow terraform destroy to delete S3 buckets that contain objects. Use with caution."
  type        = bool
  default     = false
}

variable "ecr_force_destroy_repositories" {
  description = "Allow terraform destroy to delete ECR repositories that contain images."
  type        = bool
  default     = false
}

variable "containers_dir" {
  description = <<-EOT
    Absolute path to the `containers/` directory of an extracted Poolside
    Helm bundle. The ecr submodule scans this directory for
    `<repo>__<tag>__<arch>.tar` tarballs, creates one ECR repository per
    unique <repo>, and pushes each tarball to its corresponding repo at
    the parsed tag. The bundle is expected to live outside this
    repository — there is no default. Example:

      containers_dir = "/home/ops/poolside-helm-<version>/containers"
  EOT
  type        = string

  validation {
    condition     = length(var.containers_dir) > 0
    error_message = "containers_dir must not be empty."
  }
}

variable "ecr_image_name_overrides" {
  description = <<-EOT
    Map of bundle-parsed image name -> ECR repo name (sans deployment
    prefix). Use this when a tarball's filename-derived name needs to be
    remapped for the chart (e.g. `{ forge_api = "forge-api" }`).
  EOT
  type        = map(string)
  default     = {}
}

variable "ecr_force_push_cookie" {
  description = "Opaque string passed to the ecr submodule; bump to force re-push of every image on the next apply."
  type        = string
  default     = ""
}

################################################################################
# Model checkpoints
#
# Reference-stack owns the infra side of model-checkpoint handling:
# whether to create a <deployment>-models S3 bucket, and whether to run
# this reference architecture's streaming uploader against a local directory of tarballs.
#
# The inference-chart-values side lives in modules/poolside-values. The
# operator wires reference-stack → poolside-values → helm-wrapper in
# their root.
################################################################################

variable "enable_model_s3_upload" {
  description = <<-EOT
    When true (default — the happy path for full-profile deployments),
    Terraform creates a <deployment>-models S3 bucket AND scans
    var.checkpoints_dir for *.tar files, uploading each tarball's
    contents via the model-checkpoints module.

    When false, no bucket is created and no upload runs. The operator
    pre-positions checkpoints elsewhere and supplies
    var.external_models_bucket so the inference pod's IRSA role can
    read from their bucket.

    Set to false for platform-only deployments that don't run inference.
  EOT
  type        = bool
  default     = true
}

variable "checkpoints_dir" {
  description = <<-EOT
    Absolute path to a local directory of `*.tar` model checkpoint
    archives. Required when enable_model_s3_upload=true; ignored when
    false.

    Each `*.tar` becomes an S3 upload keyed at
    `s3://<bucket>/models/checkpoints/<tarball_stem>/<file>`.
  EOT
  type        = string
  default     = ""
}

variable "use_s3_transfer_acceleration" {
  description = <<-EOT
    When true, enables S3 Transfer Acceleration on the models bucket
    AND tells the model-checkpoints uploader to use the accelerated
    endpoint. Routes uploads through CloudFront edge → AWS backbone,
    speeding up uploads from operators geographically distant from the
    bucket region (e.g. Europe ↔ us-east-2; typical 2-5x speedup).

    Costs ~$0.04/GB extra. Opt-in to avoid surprise charges. Has no
    effect when enable_model_s3_upload = false (no bucket, no upload).
  EOT
  type        = bool
  default     = false
}

variable "external_models_bucket" {
  description = <<-EOT
    Name of an externally-managed S3 bucket containing pre-positioned
    model checkpoints. Used ONLY when enable_model_s3_upload=false.

    When set, the inference pod's IRSA role is scoped to grant
    `s3:GetObject` + `s3:ListBucket` on this bucket.

    Cross-account buckets are NOT supported — the bucket must be
    in the same AWS account as the reference architecture deployment.
  EOT
  type        = string
  default     = ""
}