variable "certificates" {
  description = <<-EOT
    Map of certificates to request. validation_method must be DNS or EMAIL.
    subject_alternative_names is an optional list of additional FQDNs.
    zone_name is required for DNS validation — it is looked up via a data source.
    EOT
  type = map(object({
    domain_name               = string
    validation_method         = optional(string, "DNS")
    subject_alternative_names = optional(list(string), [])
    zone_name                 = optional(string, null)
    key_algorithm             = optional(string, "RSA_2048")
  }))
  default = {}
}

variable "wait_for_validation" {
  description = "Block until all DNS-validated certificates are issued"
  type        = bool
  default     = true
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}