variable "auth_db_migration_default_ttl_seconds" {
  description = "Default TTL for migration credentials."
  type        = number
  default     = 3600
}

variable "auth_db_migration_max_ttl_seconds" {
  description = "Maximum TTL for migration credentials."
  type        = number
  default     = 86400
}

variable "auth_db_role" {
  description = "Stable PostgreSQL owner role used by dynamic users."
  type        = string
  default     = "project_auth"
}

variable "postgres_admin_password" {
  description = "PostgreSQL admin password passed only through a write-only provider field."
  type        = string
  sensitive   = true
  ephemeral   = true
}

variable "postgres_admin_password_version" {
  description = "Increment whenever postgres_admin_password is rotated."
  type        = number
}

variable "postgres_admin_username" {
  description = "Dedicated database administration username."
  type        = string
  default     = "postgres"
}

variable "postgres_database" {
  description = "Database in which dynamic migration objects are owned and revoked."
  type        = string
  default     = "project_auth"
}

variable "postgres_host" {
  description = "Auth system PostgreSQL service DNS name."
  type        = string
  default     = "postgres.auth-system-dev.svc.cluster.local"
}

variable "postgres_port" {
  description = "Auth system PostgreSQL service port."
  type        = number
  default     = 5432
}

variable "postgres_sslmode" {
  description = "PostgreSQL SSL mode. Dev currently uses disable; production must use verify-full."
  type        = string
  default     = "disable"

  validation {
    condition     = contains(["disable", "require", "verify-ca", "verify-full"], var.postgres_sslmode)
    error_message = "postgres_sslmode must be disable, require, verify-ca, or verify-full."
  }
}

variable "vault_addr" {
  description = "Workload Vault API address."
  type        = string
  default     = "http://127.0.0.1:8200"
}

variable "vault_token" {
  description = "Short-lived token carrying vault-database-automation-dev."
  type        = string
  sensitive   = true
  ephemeral   = true
}