region   = "us-east-1"
vpc_cidr = "10.4.0.0/16"

# image_tag has no default on purpose: prod deploys must always pass an explicit
# immutable release tag, e.g. via -var="image_tag=2026.08.16-abc123".

# Prod should always terminate TLS at the ALB:
alb_certificate_arn = "" # arn:aws:acm:us-east-1:...:certificate/... (required before launch)

autoscale_min = 1
autoscale_max = 4