s3/terraform/modules/aws/variables.tf

# =============================================================================
# terraform-aws-s3 - thin AWS wrapper around the cloud-agnostic core.
#
# Reserves stable per-node addressing (ENIs with fixed private IPs) FIRST, feeds
# that address map to the core to render cloud-init, then creates instances and
# protected EBS data disks. All tiers are keyed for_each (never count), so a
# middle node can be replaced without reindexing its peers/disks.
# =============================================================================

variable "name" {
  description = "Name prefix for all resources."
  type        = string
  default     = "s3"
}

variable "vpc_id" {
  description = "VPC to deploy into."
  type        = string
}

variable "ami_id" {
  description = "AMI with the s3 binary installed (e.g. baked with Packer)."
  type        = string
}

variable "s3_binary" {
  description = "Path to s3 on the AMI."
  type        = string
  default     = "/usr/bin/s3"
}

variable "key_name" {
  description = "EC2 key pair for SSH (optional)."
  type        = string
  default     = null
}

variable "monitoring_enabled" {
  description = "Bind metrics ports and pass them through to the core."
  type        = bool
  default     = false
}

variable "enable_security" {
  description = "Enable mTLS (security.toml). Cert material must be supplied via the security variable / secret store."
  type        = bool
  default     = false
}

variable "security" {
  description = "Passed through to the core security variable when enable_security=false. When enable_security=true this is ignored and certs/JWT are generated by the security submodule."
  type        = any
  default     = {}
}

variable "internal_domain" {
  description = "Internal domain for generated component cert CNs / peer-auth wildcard (enable_security=true)."
  type        = string
  default     = "s3.internal"
}

variable "cert_dir" {
  description = "On-host directory where certs are fetched/placed."
  type        = string
  default     = "/usr/local/share/ca-certificates"
}

variable "kms_key_arn" {
  description = "KMS key ARN the instance role may use to decrypt SSM SecureStrings. Defaults to \"*\" (the SSM default key); set to a specific CMK ARN in production."
  type        = string
  default     = "*"
}

variable "termination_protection" {
  description = "Set disable_api_termination on stateful instances (masters, volumes)."
  type        = bool
  default     = true
}

# ---- stateful tiers: keyed node maps ---------------------------------------
variable "masters" {
  description = "Master nodes keyed by stable id (m0/m1/m2). Quorum size must be odd."
  type = map(object({
    subnet_id     = string
    private_ip    = string
    instance_type = optional(string, "t3.medium")
  }))
  validation {
    condition     = length(var.masters) % 2 == 1
    error_message = "Master quorum must be an odd number of nodes (1, 3, 5)."
  }
}

variable "volumes" {
  description = "Volume nodes keyed by stable id. Each owns one protected EBS data disk."
  type = map(object({
    subnet_id           = string
    availability_zone   = string
    private_ip          = string
    instance_type       = optional(string, "m5.large")
    rack                = optional(string)
    data_center         = optional(string)
    data_volume_size_gb = optional(number, 100)
    data_volume_type    = optional(string, "gp3")
    data_volume_iops    = optional(number, null)
  }))
  default = {}
}

variable "filers" {
  description = "Filer nodes keyed by stable id. Each owns a protected EBS disk for its leveldb2 store."
  type = map(object({
    subnet_id           = string
    availability_zone   = string
    private_ip          = string
    instance_type       = optional(string, "t3.medium")
    data_volume_size_gb = optional(number, 50)
  }))
  default = {}
}

variable "s3_nodes" {
  description = "Standalone S3 gateway nodes keyed by stable id (stateless)."
  type = map(object({
    subnet_id     = string
    private_ip    = string
    instance_type = optional(string, "t3.medium")
  }))
  default = {}
}

variable "embedded_s3" {
  description = "Embed the S3 gateway in the filer instead of standalone nodes."
  type = object({
    enabled     = optional(bool, false)
    port        = optional(number, 8333)
    domain_name = optional(string, "")
  })
  default = {}
}

variable "s3_identities" {
  description = "Non-admin S3 identities for the gateway config (admin key goes via EnvironmentFile)."
  type = list(object({
    name       = string
    access_key = string
    secret_key = string
    actions    = list(string)
  }))
  default   = []
  sensitive = true
}

# ---- networking ------------------------------------------------------------
variable "client_ingress_cidrs" {
  description = "CIDRs allowed to reach the client-facing S3 (8333) and filer (8888) ports."
  type        = list(string)
  default     = []
}

variable "ssh_ingress_cidrs" {
  description = "CIDRs allowed SSH (22)."
  type        = list(string)
  default     = []
}

variable "tags" {
  description = "Extra tags applied to all resources."
  type        = map(string)
  default     = {}
}