variables.tf

# General variables
variable "project_name" {
  description = "Project name, used for resource naming"
  type        = string
  default     = "secure-db"
}

variable "environment" {
  description = "Environment (dev, staging, prod)"
  type        = string
  default     = "dev"
  
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be one of: dev, staging, prod."
  }
}

variable "location" {
  description = "Azure region for resource deployment"
  type        = string
  default     = "West Europe"
}

variable "resource_group_name" {
  description = "Resource group name"
  type        = string
  default     = null
}

# Network variables
variable "vnet_address_space" {
  description = "CIDR block for virtual network"
  type        = list(string)
  default     = ["10.0.0.0/16"]
}

variable "database_subnet_address_prefixes" {
  description = "CIDR block for database subnet"
  type        = list(string)
  default     = ["10.0.1.0/24"]
}

variable "private_endpoint_subnet_address_prefixes" {
  description = "CIDR block for private endpoint subnet"
  type        = list(string)
  default     = ["10.0.2.0/24"]
}

# Database variables
variable "cosmos_db_name" {
  description = "Cosmos DB account name"
  type        = string
  default     = null
}

variable "database_throughput" {
  description = "Database throughput (RU/s)"
  type        = number
  default     = 400
  
  validation {
    condition     = var.database_throughput >= 400 && var.database_throughput <= 1000000
    error_message = "Database throughput must be between 400 and 1000000 RU/s."
  }
}

variable "backup_retention_days" {
  description = "Number of days to retain backups"
  type        = number
  default     = 7
  
  validation {
    condition     = var.backup_retention_days >= 1 && var.backup_retention_days <= 35
    error_message = "Backup retention period must be between 1 and 35 days."
  }
}

# Security variables
variable "enable_private_endpoint" {
  description = "Enable private endpoint for database"
  type        = bool
  default     = true
}

variable "allowed_ip_ranges" {
  description = "List of IP addresses/ranges allowed to access the database"
  type        = list(string)
  default     = []
}

variable "enable_encryption_at_rest" {
  description = "Enable encryption at rest"
  type        = bool
  default     = true
}

variable "enable_audit_logging" {
  description = "Enable audit logging"
  type        = bool
  default     = true
}

# Key Vault variables
variable "key_vault_sku" {
  description = "SKU for Key Vault"
  type        = string
  default     = "standard"
  
  validation {
    condition     = contains(["standard", "premium"], var.key_vault_sku)
    error_message = "Key Vault SKU must be standard or premium."
  }
}

# Tags
variable "common_tags" {
  description = "Common tags for all resources"
  type        = map(string)
  default = {
    Project     = "SecureDatabase"
    ManagedBy   = "Terraform"
    Owner       = "Platform Team"
    Environment = "dev"
  }
}

# RBAC variables
variable "database_administrators" {
  description = "List of users/groups with administrative rights on the database"
  type        = list(string)
  default     = []
}

variable "database_readers" {
  description = "List of users/groups with read access to the database"
  type        = list(string)
  default     = []
}

variable "database_writers" {
  description = "List of users/groups with write access to the database"
  type        = list(string)
  default     = []
}