variables.tf

########################
#### Module toggles ####
########################
variable "enable_vpc" {
  description = "Toggles the comet_vpc module, to provision a new VPC for hosting the Comet resources"
  type        = bool
}

variable "enable_ec2" {
  description = "Toggles the comet_ec2 module, to provision EC2 resources for running Comet"
  type        = bool
  default     = false
}

variable "enable_ec2_alb" {
  description = "Toggles the comet_ec2_alb module, to provision an ALB in front of the EC2 instance"
  type        = bool
}

variable "enable_eks" {
  description = "Toggles the comet_eks module, to provision EKS resources for running Comet"
  type        = bool
}

variable "enable_elasticache" {
  description = "Toggles the comet_elasticache module for provisioning Comet Redis on elasticache"
  type        = bool
}

variable "enable_rds" {
  description = "Toggles the comet_rds module for provisioning Comet RDS database"
  type        = bool
}

variable "enable_s3" {
  description = "Toggles the comet_s3 module for provisioning Comet S3 bucket"
  type        = bool
}

variable "enable_mpm_infra" {
  description = "Creates S3 buckets for MPM Druid/Airflow workloads (used by comet_s3 module)"
  type        = bool
  default     = false
}

variable "enable_loki_bucket" {
  description = "Enable creation of S3 bucket for Loki logs (used by comet_s3 module)"
  type        = bool
  default     = true
}

variable "eks_enable_karpenter" {
  description = "Enable Karpenter prerequisites in the EKS module: discovery tags, SQS interruption queue, EventBridge rules, node IAM role/instance profile, and controller IRSA role"
  type        = bool
  default     = false
}

variable "enable_cloudwatch_exporter" {
  description = "Enable CloudWatch Exporter IRSA role for scraping ElastiCache, RDS, and other AWS managed service metrics (used by comet_eks module)"
  type        = bool
  default     = false
}

variable "enable_monitoring_setup" {
  description = "Enable monitoring namespace and Grafana credentials secret in EKS (used by comet_eks module)"
  type        = bool
  default     = true
}

variable "monitoring_namespace" {
  description = "Kubernetes namespace for monitoring resources"
  type        = string
  default     = "monitoring"
}

variable "enable_secretsmanager" {
  description = "Toggles the comet_secretsmanager module for provisioning Comet Secrets Manager secrets. Requires enable_rds and enable_elasticache to be true."
  type        = bool
  default     = true
}

variable "enable_config_secret" {
  description = "Enable creation of the config secret (cometml/{environment}/config)"
  type        = bool
  default     = true
}

variable "enable_monitoring_secret" {
  description = "Enable creation of the monitoring-secrets secret (cometml/{environment}/monitoring-secrets)"
  type        = bool
  default     = true
}

variable "enable_clickhouse_secret" {
  description = "Enable creation of the clickhouse secret (cometml/{environment}/clickhouse)"
  type        = bool
  default     = true
}

################
#### Global ####
################
variable "environment" {
  description = "Deployment environment, i.e. dev/stage/prod, etc"
  type        = string
  default     = "dev"
}

variable "secretsmanager_environment" {
  description = "Environment name used for Secrets Manager secret paths (e.g., cometml/{secretsmanager_environment}/config). Defaults to 'environment' if not set. Useful for multi-region deployments where infrastructure names include region but secrets should be region-agnostic."
  type        = string
  default     = null
}

variable "comet_hostname" {
  description = "Hostname prefix for the Comet deployment (e.g., 'mercedesamgf1' results in 'mercedesamgf1.comet-hosted.com'). Defaults to 'environment' if not set. Useful for multi-region deployments where infrastructure names include region but hostnames should be region-agnostic."
  type        = string
  default     = null
}

variable "rds_environment" {
  description = "Override environment name for RDS resource naming. When null, falls back to var.environment. Use this when the environment was shortened but RDS resources were originally created with a longer name."
  type        = string
  default     = null
}

variable "rds_cluster_identifier" {
  description = "Override for the RDS cluster identifier. When null, uses the default pattern. Use this when the cluster was created with a different naming convention than the current module version."
  type        = string
  default     = null
}

variable "rds_instance_identifier_prefix" {
  description = "Override prefix for RDS instance identifiers. When null, uses the default pattern. Instance index is appended automatically."
  type        = string
  default     = null
}

variable "region" {
  description = "AWS region to provision resources in"
  type        = string
}

variable "availability_zones" {
  description = "List of availability zones from region"
  type        = list(string)
  default     = null
}

variable "comet_vpc_id" {
  description = "ID of an existing VPC to provision resources in"
  type        = string
  default     = null
}

variable "comet_private_subnets" {
  description = "List of private subnets IDs from existing VPC to provision resources in"
  type        = list(string)
  default     = null
}

variable "comet_public_subnets" {
  description = "List of public subnets IDs from existing VPC to provision resources in"
  type        = list(string)
  default     = null
}

#######################
#### Module inputs ####
#######################

#### comet_vpc ####
variable "vpc_cidr" {
  description = "CIDR block for the VPC to provision"
  type        = string
  default     = "10.0.0.0/16"
}

#### comet_ec2 ####
variable "comet_ec2_ami_type" {
  type        = string
  description = "Operating system type for the EC2 instance AMI"
  default     = "ubuntu22"
  validation {
    condition     = can(regex("^al2$|^al2023$|^rhel(7|8|9)$|^ubuntu(18|20|22)$", var.comet_ec2_ami_type))
    error_message = "Invalid OS type. Allowed values are 'al2', 'al2023', 'rhel7', 'rhel8', 'rhel9', 'ubuntu20', 'ubuntu22'."
  }
}

variable "comet_ec2_ami_id" {
  description = "AMI ID for the EC2 instance"
  type        = string
  default     = ""
}

variable "comet_ec2_instance_type" {
  description = "Instance type for the EC2 instance"
  type        = string
  default     = "m7i.4xlarge"
}

variable "comet_ec2_instance_count" {
  description = "Number of EC2 instances to provision"
  type        = number
  default     = 1
}

variable "comet_ec2_volume_type" {
  description = "EBS volume type for the EC2 instance root volume"
  type        = string
  default     = "gp3"
}

variable "comet_ec2_volume_size" {
  description = "Size, in gibibytes (GiB), for the EC2 instance root volume"
  type        = number
  default     = 1024
}

variable "comet_ec2_key" {
  description = "Name of the SSH key to configure on the EC2 instance"
  type        = string
  default     = null
}

#### ACM Certificate ####
variable "enable_acm_certificate" {
  description = "Enable creation of an ACM certificate for {environment}.comet-hosted.com and *.{environment}.comet-hosted.com"
  type        = bool
  default     = false
}

variable "acm_domain_name" {
  description = "Base domain name for the ACM certificate. Defaults to '{comet_hostname}.comet-hosted.com'"
  type        = string
  default     = null
}

variable "acm_route53_zone_id" {
  description = "Route 53 hosted zone ID for DNS validation. Required when enable_acm_certificate is true."
  type        = string
  default     = null
}

variable "acm_wait_for_validation" {
  description = "Whether to wait for the certificate to be validated before completing"
  type        = bool
  default     = true
}

#### comet_ec2_alb ####
variable "ssl_certificate_arn" {
  description = "ARN of the ACM certificate to use for the ALB. If enable_acm_certificate is true and this is not set, the created certificate will be used."
  type        = string
  default     = null
}

#### comet_eks ####
variable "eks_cluster_name" {
  description = "Name for EKS cluster"
  type        = string
  default     = "comet-eks"
}

variable "eks_cluster_version" {
  description = "Kubernetes version of the EKS cluster"
  type        = string
  default     = "1.34"
}

variable "eks_cluster_endpoint_public_access" {
  description = "Enable public access to the EKS cluster API endpoint"
  type        = bool
  default     = true
}

variable "eks_cluster_endpoint_private_access" {
  description = "Enable private access to the EKS cluster API endpoint"
  type        = bool
  default     = false
}

variable "eks_cluster_security_group_additional_rules" {
  description = "Additional security group rules for the EKS cluster security group (e.g., for VPN access)"
  type        = any
  default     = {}
}

variable "eks_private_access_cidrs" {
  description = "List of CIDR blocks that can access the EKS API via private endpoint (e.g., VPN subnets). Only applied when private endpoint access is enabled."
  type        = list(string)
  default     = []
}

variable "eks_authentication_mode" {
  description = "Authentication mode for the EKS cluster. Valid values: CONFIG_MAP, API, API_AND_CONFIG_MAP"
  type        = string
  default     = "API_AND_CONFIG_MAP"

  validation {
    condition     = contains(["CONFIG_MAP", "API", "API_AND_CONFIG_MAP"], var.eks_authentication_mode)
    error_message = "Authentication mode must be CONFIG_MAP, API, API_AND_CONFIG_MAP."
  }
}

variable "eks_enable_cluster_creator_admin_permissions" {
  description = "Grant the cluster creator admin permissions via EKS access entry"
  type        = bool
  default     = true
}

variable "eks_admin_role_arns" {
  description = "List of IAM role ARNs to grant AmazonEKSClusterAdminPolicy via EKS Access Entries"
  type        = list(string)
  default     = []
}

variable "eks_kms_key_administrators" {
  description = "List of IAM ARNs (users/roles) that should have administrator access to the EKS KMS key. These principals can manage the key (update, delete, etc.)."
  type        = list(string)
  default     = []
}

variable "eks_kms_key_users" {
  description = "List of IAM ARNs (users/roles) that should have usage access to the EKS KMS key. These principals can use the key for encryption/decryption operations."
  type        = list(string)
  default     = []
}

variable "eks_mng_ami_type" {
  description = "AMI family to use for the EKS nodes (default for all nodegroups). Ignored if eks_mng_ami_id is set."
  type        = string
  default     = "AL2023_x86_64_STANDARD"
}

variable "eks_admin_ami_type" {
  description = "AMI type override for admin nodegroup. Null uses the default (eks_mng_ami_type)."
  type        = string
  default     = null
}

variable "eks_comet_ami_type" {
  description = "AMI type override for comet nodegroup. Set to AL2023_ARM_64_STANDARD for Graviton."
  type        = string
  default     = null
}

variable "eks_clickhouse_ami_type" {
  description = "AMI type override for ClickHouse nodegroup. Null uses the default (eks_mng_ami_type)."
  type        = string
  default     = null
}

variable "eks_mng_ami_id" {
  description = "Specific AMI ID to use for all EKS node groups (e.g., ami-0123456789abcdef0). If set, overrides eks_mng_ami_type."
  type        = string
  default     = null
}

# Node Group Toggles
variable "eks_enable_admin_node_group" {
  description = "Enable admin node group for EKS cluster management tasks"
  type        = bool
  default     = true
}

variable "eks_enable_comet_node_group" {
  description = "Enable comet node group for main Comet application workloads"
  type        = bool
  default     = true
}

variable "eks_enable_druid_node_group" {
  description = "Enable druid node group for Apache Druid workloads (requires enable_mpm_infra to be true)"
  type        = bool
  default     = true
}

variable "eks_enable_airflow_node_group" {
  description = "Enable airflow node group for Apache Airflow workloads (requires enable_mpm_infra to be true)"
  type        = bool
  default     = true
}

variable "eks_enable_clickhouse_node_group" {
  description = "Enable dedicated ClickHouse node group"
  type        = bool
  default     = true
}

# Admin Node Group Variables
variable "eks_admin_name" {
  description = "Name for the admin node group"
  type        = string
  default     = "admin"
}

variable "eks_admin_instance_types" {
  description = "Instance types for admin node group"
  type        = list(string)
  default     = ["t3.large"]
}

variable "eks_admin_min_size" {
  description = "Minimum number of nodes in admin node group"
  type        = number
  default     = 1
}

variable "eks_admin_max_size" {
  description = "Maximum number of nodes in admin node group"
  type        = number
  default     = 3
}

variable "eks_admin_desired_size" {
  description = "Desired number of nodes in admin node group"
  type        = number
  default     = 2
}

# Comet Node Group Variables
variable "eks_comet_name" {
  description = "Name for the comet node group"
  type        = string
  default     = "comet"
}

variable "eks_comet_instance_types" {
  description = "Instance types for comet node group"
  type        = list(string)
  default     = ["m7i.4xlarge"]
}

variable "eks_comet_min_size" {
  description = "Minimum number of nodes in comet node group"
  type        = number
  default     = 2
}

variable "eks_comet_max_size" {
  description = "Maximum number of nodes in comet node group"
  type        = number
  default     = 10
}

variable "eks_comet_desired_size" {
  description = "Desired number of nodes in comet node group"
  type        = number
  default     = 3
}

variable "eks_mng_disk_size" {
  description = "Size of the storage disks for nodes in EKS cluster"
  type        = number
  default     = 500
}

variable "eks_aws_load_balancer_controller" {
  description = "Enables the AWS Load Balancer Controller in the EKS cluster"
  type        = bool
  default     = true
}

variable "eks_cert_manager" {
  description = "Enables cert-manager in the EKS cluster"
  type        = bool
  default     = false
}

variable "eks_aws_cloudwatch_metrics" {
  description = "Enables AWS Cloudwatch Metrics in the EKS cluster"
  type        = bool
  default     = false
}

variable "eks_external_dns" {
  description = "Enables ExternalDNS in the EKS cluster"
  type        = bool
  default     = false
}

variable "eks_external_dns_r53_zones" {
  description = "Route 53 zones for external-dns to have access to"
  type        = list(string)
  default = [
    "arn:aws:route53:::hostedzone/XYZ"
  ]
}

variable "eks_enable_metrics_server" {
  description = "Enables the metrics-server EKS managed addon (required for HPA and `kubectl top`). Also opens node SG port 10251 so the kube-apiserver can reach the metrics-server pod."
  type        = bool
  default     = true
}

variable "eks_metrics_server_addon_version" {
  description = "Pinned version of the metrics-server EKS managed addon. Set to null to use the AWS default for the cluster's Kubernetes version."
  type        = string
  default     = null
}

variable "eks_enable_cluster_autoscaler" {
  description = "Enables the Cluster Autoscaler IRSA role and ASG auto-discovery tags. The cluster-autoscaler Helm release itself is deployed out-of-band (ArgoCD AppSet). Toggling this creates the IAM role and tags the EKS-managed ASGs so the autoscaler can discover and scale them."
  type        = bool
  default     = false
}

# Druid Node Group Variables
variable "eks_druid_name" {
  description = "Name for the druid node group"
  type        = string
  default     = "druid"
}

variable "eks_druid_instance_types" {
  description = "Instance types for druid node group"
  type        = list(string)
  default     = ["m7i.2xlarge"]
}

variable "eks_druid_min_size" {
  description = "Minimum number of nodes in druid node group"
  type        = number
  default     = 2
}

variable "eks_druid_max_size" {
  description = "Maximum number of nodes in druid node group"
  type        = number
  default     = 8
}

variable "eks_druid_desired_size" {
  description = "Desired number of nodes in druid node group"
  type        = number
  default     = 4
}

# Airflow Node Group Variables
variable "eks_airflow_name" {
  description = "Name for the airflow node group"
  type        = string
  default     = "airflow"
}

variable "eks_airflow_instance_types" {
  description = "Instance types for airflow node group"
  type        = list(string)
  default     = ["t3.medium"]
}

variable "eks_airflow_min_size" {
  description = "Minimum number of nodes in airflow node group"
  type        = number
  default     = 1
}

variable "eks_airflow_max_size" {
  description = "Maximum number of nodes in airflow node group"
  type        = number
  default     = 4
}

variable "eks_airflow_desired_size" {
  description = "Desired number of nodes in airflow node group"
  type        = number
  default     = 2
}

# ClickHouse Node Group Variables
variable "eks_clickhouse_name" {
  description = "Name for the ClickHouse node group"
  type        = string
  default     = "clickhouse"
}

variable "eks_clickhouse_instance_types" {
  description = "Instance types for the ClickHouse node group"
  type        = list(string)
  default     = ["m7i.2xlarge"]
}

variable "eks_clickhouse_min_size" {
  description = "Minimum number of ClickHouse nodes"
  type        = number
  default     = 2
}

variable "eks_clickhouse_max_size" {
  description = "Maximum number of ClickHouse nodes"
  type        = number
  default     = 3
}

variable "eks_clickhouse_desired_size" {
  description = "Desired number of ClickHouse nodes"
  type        = number
  default     = 2
}

variable "eks_clickhouse_volume_size" {
  description = "EBS volume size in GB for ClickHouse nodes"
  type        = number
  default     = 500
}

variable "eks_clickhouse_volume_type" {
  description = "EBS volume type for ClickHouse nodes"
  type        = string
  default     = "gp3"
}

variable "eks_clickhouse_volume_encrypted" {
  description = "Enable EBS encryption for ClickHouse volumes"
  type        = bool
  default     = true
}

variable "eks_clickhouse_delete_on_termination" {
  description = "Delete EBS volumes on instance termination"
  type        = bool
  default     = true
}

variable "eks_clickhouse_taints" {
  description = "Taints to apply to ClickHouse node group"
  type = list(object({
    key    = string
    value  = string
    effect = string
  }))
  default = [
    {
      key    = "clickhouse"
      value  = "true"
      effect = "NO_SCHEDULE"
    }
  ]
}

# Karpenter Node Group Variables
# Used only when eks_enable_karpenter = true. See modules/comet_eks/variables.tf for details.

variable "eks_karpenter_node_instance_types" {
  description = "Instance types for the Karpenter controller node group"
  type        = list(string)
  default     = ["t3.medium", "t3a.medium"]
}

variable "eks_karpenter_node_min_size" {
  description = "Minimum number of nodes in the Karpenter controller node group"
  type        = number
  default     = 1
}

variable "eks_karpenter_node_max_size" {
  description = "Maximum number of nodes in the Karpenter controller node group"
  type        = number
  default     = 2
}

variable "eks_karpenter_node_desired_size" {
  description = "Desired number of nodes in the Karpenter controller node group"
  type        = number
  default     = 1
}

variable "eks_karpenter_node_disk_size" {
  description = "EBS root volume size in GB for Karpenter controller nodes"
  type        = number
  default     = 50
}

variable "eks_admin_karpenter_instance_types" {
  description = "Instance types for the admin node group when Karpenter is enabled. These nodes run system workloads only (cert-manager, LBC, etc.) so smaller instances are appropriate."
  type        = list(string)
  default     = ["t3.medium", "t3a.medium"]
}

variable "eks_karpenter_chart_version" {
  description = "Version of the comet-stsaas-karpenter Helm chart to install from helm.comet.com"
  type        = string
  default     = "0.1.0"
}

variable "eks_karpenter_helm_username" {
  description = "Username for the helm.comet.com Helm repository"
  type        = string
  sensitive   = true
  default     = ""
}

variable "eks_karpenter_helm_password" {
  description = "Password for the helm.comet.com Helm repository"
  type        = string
  sensitive   = true
  default     = ""
}

variable "eks_karpenter_extra_tags" {
  description = "Extra EC2 instance tags applied to all Karpenter-provisioned nodes (e.g. Environment)"
  type        = map(string)
  default     = {}
}

variable "eks_additional_node_groups" {
  description = "Additional EKS managed node groups to create beyond the predefined ones (admin, comet, druid, airflow, clickhouse)"
  type        = any
  default     = {}
}

variable "eks_additional_s3_bucket_arns" {
  description = "Additional S3 bucket ARNs to grant access to from EKS node groups (for buckets created outside this module)"
  type        = list(string)
  default     = []
}

variable "eks_enable_external_secrets" {
  description = "Enable External Secrets IRSA role and Helm chart for accessing AWS Secrets Manager from EKS"
  type        = bool
  default     = true
}

variable "eks_external_secrets_chart_version" {
  description = "Helm chart version for external-secrets"
  type        = string
  default     = "2.2.0"
}

variable "eks_storage_class_reclaim_policy" {
  description = "Reclaim policy for the gp3 and comet-generic StorageClasses. Use 'Retain' to preserve volumes after PVC deletion (recommended for production), or 'Delete' to automatically delete volumes. Note: StorageClass reclaimPolicy is immutable; existing deployments require StorageClass deletion and recreation."
  type        = string
  default     = "Retain"

  validation {
    condition     = contains(["Retain", "Delete"], var.eks_storage_class_reclaim_policy)
    error_message = "Must be 'Retain' or 'Delete'."
  }
}

#### comet_elasticache ####
variable "elasticache_allow_from_sg" {
  description = "Security group from which to allow connections to ElastiCache, to use when provisioning with existing compute"
  type        = string
  default     = null
}

variable "elasticache_engine" {
  description = "Engine type for ElastiCache cluster"
  type        = string
  default     = "redis"
}

variable "elasticache_engine_version" {
  description = "Version number for ElastiCache engine"
  type        = string
  default     = "7.1"
}

variable "elasticache_instance_type" {
  description = "ElastiCache instance type"
  type        = string
  default     = "cache.r4.xlarge"
}

variable "elasticache_param_group_name" {
  description = "Name for the ElastiCache cluster parameter group"
  type        = string
  default     = "default.redis7"
}

variable "elasticache_num_cache_nodes" {
  description = "Number of nodes in the ElastiCache cluster"
  type        = number
  default     = 1
}

variable "elasticache_transit_encryption" {
  description = "Enable transit encryption for ElastiCache"
  type        = bool
  default     = true
}

variable "elasticache_auth_token" {
  description = "Auth token for ElastiCache"
  type        = string
  default     = null
}

variable "elasticache_automatic_failover_enabled" {
  description = "Enable automatic failover for the ElastiCache replication group. Requires at least one replica (elasticache_num_cache_nodes >= 2)."
  type        = bool
  default     = false
}

variable "elasticache_multi_az_enabled" {
  description = "Enable Multi-AZ for the ElastiCache replication group. Requires automatic_failover to also be enabled and at least one replica in a different AZ."
  type        = bool
  default     = false
}

#### comet_rds ####
variable "rds_allow_from_sg" {
  description = "Security group from which to allow connections to RDS, to use when provisioning with existing compute"
  type        = string
  default     = null
}

variable "rds_engine" {
  description = "Engine type for RDS database"
  type        = string
  default     = "aurora-mysql"
}

variable "rds_engine_version" {
  description = "Engine version number for RDS database"
  type        = string
  default     = "8.0"
}

variable "rds_instance_type" {
  description = "Instance type for RDS database"
  type        = string
  default     = "db.r5.xlarge"
}

variable "rds_instance_count" {
  description = "Number of RDS instances in the database cluster"
  type        = number
  default     = 2
}

variable "rds_storage_encrypted" {
  description = "Enables encryption for RDS storage"
  type        = bool
  default     = true
}

variable "rds_iam_db_auth" {
  description = "Enables IAM auth for the database in RDS"
  type        = bool
  default     = true
}

variable "rds_backup_retention_period" {
  description = "Days specified for RDS snapshot retention period"
  type        = number
  default     = 14
}

variable "rds_preferred_backup_window" {
  description = "Backup window for RDS (UTC)"
  type        = string
  default     = "02:00-04:00"
}

variable "rds_deletion_protection" {
  description = "Enable deletion protection for RDS cluster"
  type        = bool
  default     = true
}

variable "rds_storage_type" {
  description = "Aurora storage type. Use 'aurora-iopt1' for I/O-Optimized (eliminates I/O charges, 30% instance surcharge). Default null uses Aurora Standard."
  type        = string
  default     = null
}

variable "rds_database_name" {
  description = "Name for the application database in RDS"
  type        = string
  default     = "logger"
}

variable "rds_master_username" {
  description = "Master username for RDS database"
  type        = string
  default     = "admin"
}

variable "rds_master_password" {
  description = "Master password for RDS database. If not provided, a random password will be generated and stored in Secrets Manager."
  type        = string
  default     = null
  sensitive   = true
}

variable "rds_snapshot_identifier" {
  description = "Snapshot identifier to restore the RDS cluster from. If provided, the cluster will be restored from this snapshot instead of being created fresh."
  type        = string
  default     = null
}

variable "rds_kms_key_id" {
  description = "ARN of the KMS key to use for encryption. Required when restoring from a KMS-encrypted shared snapshot. If not specified, the default RDS KMS key will be used."
  type        = string
  default     = null
}

variable "rds_performance_insights_enabled" {
  description = "Enable Performance Insights for RDS instances"
  type        = bool
  default     = true
}

variable "rds_performance_insights_retention_period" {
  description = "Retention period for Performance Insights data in days. Valid values are 7, 31, 62, 93, 124, 155, 186, 217, 248, 279, 310, 341, 372, 403, 434, 465, 496, 527, 558, 589, 620, 651, 682, 713, or 731."
  type        = number
  default     = 7
}

variable "rds_performance_insights_kms_key_id" {
  description = "ARN of KMS key to encrypt Performance Insights data. If not specified, the default RDS KMS key will be used."
  type        = string
  default     = null
}

variable "rds_enhanced_monitoring_interval" {
  description = "Interval in seconds for Enhanced Monitoring metrics collection. Valid values are 0, 1, 5, 10, 15, 30, 60. Set to 0 to disable Enhanced Monitoring."
  type        = number
  default     = 60
}

#### comet_s3 ####
variable "s3_bucket_name" {
  description = "Name for S3 bucket"
  type        = string
}

variable "s3_force_destroy" {
  description = "Option to enable force delete of S3 bucket"
  type        = bool
  default     = false
}

#### comet_vpc ####
variable "single_nat_gateway" {
  description = "Controls whether single NAT gateway used for all public subnets"
  type        = bool
  default     = true
}

variable "common_tags" {
  description = "A map of tags to apply to resources"
  type        = map(string)
}

variable "environment_tag" {
  description = "Deployment identifier"
  type        = string
  default     = ""
}

#### comet_secretsmanager ####
variable "sendgrid_api_key" {
  description = "Base64 encoded SendGrid API key (required when enable_secretsmanager is true)"
  type        = string
  default     = ""
  sensitive   = true
}

variable "secret_seed" {
  description = "Secret seed value for Comet. If not provided, a random value will be generated."
  type        = string
  default     = null
  sensitive   = true
}

variable "s3_key" {
  description = "S3 key configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
}

variable "s3_secret" {
  description = "S3 secret configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
  sensitive   = true
}

variable "s3_private_key" {
  description = "S3 private key configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
}

variable "s3_private_secret" {
  description = "S3 private secret configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
  sensitive   = true
}

variable "s3_public_key" {
  description = "S3 public key configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
}

variable "s3_public_secret" {
  description = "S3 public secret configuration for Secrets Manager"
  type        = string
  default     = "IAM-ROLE"
  sensitive   = true
}

variable "redis_token" {
  description = "Redis auth token for Secrets Manager"
  type        = string
  default     = "NA"
  sensitive   = true
}

#### comet_secretsmanager - monitoring secret ####
variable "grafana_admin_user" {
  description = "Grafana admin username for monitoring secret"
  type        = string
  default     = "admin"
}

variable "grafana_admin_password" {
  description = "Grafana admin password for monitoring secret. Required when enable_monitoring_secret is true."
  type        = string
  default     = null
  sensitive   = true
}

#### comet_secretsmanager - clickhouse secret ####
variable "clickhouse_monitoring_password" {
  description = "ClickHouse monitoring password for clickhouse secret. Required when enable_clickhouse_secret is true."
  type        = string
  default     = null
  sensitive   = true
}

variable "clickhouse_agentro_password" {
  description = "ClickHouse password for the read-only agentro user. If null and enable_clickhouse_secret is true, a random 32-char password is generated."
  type        = string
  default     = null
  sensitive   = true
}

variable "clickhouse_admin_password" {
  description = "ClickHouse password for the opik admin user. If null and enable_clickhouse_secret is true, a random 32-char password is generated."
  type        = string
  default     = null
  sensitive   = true
}

variable "clickhouse_host" {
  description = "In-cluster DNS name of the ClickHouse HTTP service (used by the comet-monitoring clickhouse-exporter). If null, defaults to `clickhouse-opik-clickhouse.{environment}.svc.cluster.local`."
  type        = string
  default     = null
}

variable "clickhouse_port" {
  description = "ClickHouse HTTP port (used by clickhouse-exporter)."
  type        = string
  default     = "8123"
}

variable "clickhouse_monitoring_username" {
  description = "ClickHouse user the monitoring exporter authenticates as. Default matches the user the comet-ml chart provisions."
  type        = string
  default     = "opikmonitoring"
}

variable "rds_cluster_parameters" {
  description = "Additional MySQL parameters applied to the cluster parameter group on top of the module's baseline character-set/collation/innodb defaults. Defaults include operational tunings (wait_timeout, max_execution_time, innodb purge settings, aurora_read_replica_read_committed) used across Comet STSAAS deployments. Pass [] to disable, or override with a custom list."
  type = list(object({
    name         = string
    value        = string
    apply_method = string
  }))
  default = [
    { name = "aurora_read_replica_read_committed", value = "ON", apply_method = "immediate" },
    { name = "innodb_max_purge_lag", value = "1000000", apply_method = "immediate" },
    { name = "innodb_max_purge_lag_delay", value = "300000", apply_method = "immediate" },
    { name = "innodb_purge_batch_size", value = "5000", apply_method = "immediate" },
    { name = "innodb_purge_threads", value = "16", apply_method = "pending-reboot" },
    { name = "max_execution_time", value = "60000", apply_method = "immediate" },
    { name = "wait_timeout", value = "1800", apply_method = "immediate" },
  ]
}