variable "name" {
  type = string
}

variable "environment" {
  description = "Environment name for alarm namespaces (dev/staging/prod)"
  type        = string
}

variable "region" {
  type = string
}

variable "cluster_name" {
  type    = string
  default = ""
}

variable "vpc_id" {
  type = string
}

variable "public_subnet_ids" {
  type = list(string)
}

variable "private_subnet_ids" {
  type = list(string)
}

variable "image_tag" {
  description = "Container image tag to deploy (e.g. a git SHA)"
  type        = string
  default     = "latest"
}

variable "container_port" {
  type    = number
  default = 8000
}

variable "task_cpu" {
  description = "Fargate CPU units (256/512/1024/2048)"
  type        = number
  default     = 512
}

variable "task_memory" {
  description = "Fargate memory in MiB (must pair with cpu)"
  type        = number
  default     = 1024
}

variable "desired_count" {
  type    = number
  default = 1
}

variable "enable_worker" {
  description = "Run the single-instance CMS polling worker service (cms_polling_worker loop)"
  type        = bool
  default     = true
}

variable "enable_autoscaling" {
  type    = bool
  default = false
}

variable "autoscale_min" {
  type    = number
  default = 1
}

variable "autoscale_max" {
  type    = number
  default = 4
}

# access_core/settings has no production.py; base is the module used by infra.
variable "django_settings_module" {
  type    = string
  default = "access_core.settings.base"
}

variable "postgres_host" {
  description = "RDS endpoint address (wired by the environment root)"
  type        = string
}

variable "postgres_db" {
  type    = string
  default = "access_core"
}

variable "postgres_user" {
  type    = string
  default = "access_user"
}

variable "db_secret_arn" {
  description = "Secrets Manager secret holding the RDS password (key: password)"
  type        = string
}

variable "app_secrets_arn" {
  description = "Secrets Manager secret for app secrets (key: django-secret-key)"
  type        = string
}

variable "extra_environment" {
  description = "Additional non-sensitive environment vars (e.g. PHI_KMS_KEY_ID, CMS_API_BASE_URL)"
  type        = map(string)
  default     = {}
}

variable "s3_bucket_arn" {
  type    = string
  default = ""
}

variable "queue_arn" {
  type    = string
  default = ""
}

variable "kms_key_arn" {
  description = "PHI field-encryption KMS key (empty disables task KMS access)"
  type        = string
  default     = ""
}

variable "pseudonymization_key_arn" {
  type    = string
  default = ""
}

variable "queue_kms_key_arn" {
  description = "KMS key backing the SQS queues (for decrypt access)"
  type        = string
  default     = ""
}

variable "enable_kms_queue_access" {
  type    = bool
  default = false
}

variable "alb_certificate_arn" {
  description = "ACM certificate for HTTPS listener (empty serves HTTP-only, dev)"
  type        = string
  default     = ""
}

variable "log_retention_days" {
  type    = number
  default = 30
}

variable "enable_alarms" {
  description = "Create CloudWatch alarms (staging/prod)"
  type        = bool
  default     = false
}

variable "queue_depth_alarm_threshold" {
  type    = number
  default = 100
}

variable "alarm_action_arns" {
  description = "SNS topic ARNs notified when CloudWatch alarms fire (empty = console-only)"
  type        = list(string)
  default     = []
}

variable "tags" {
  type    = map(string)
  default = {}
}