# Variables ====================================================================

variable "tags" {
  description = "Tags applied to all resources in this module."
  type        = map(string)
  default     = {}
}

variable "name" {
  description = "Name used for the filesystem and derived resource names."
  type        = string
}

variable "subnet_ids" {
  description = <<-EOT
    Subnet IDs for the filesystem.
    Single-element list for SINGLE_AZ_2. Two-element list (preferred + standby) for MULTI_AZ_1.
  EOT
  type        = list(string)
}

variable "vpc_id" {
  description = "VPC ID in which the FSx security group will be created."
  type        = string
}

variable "allowed_security_group_ids" {
  description = "Security group IDs permitted to mount the filesystem (SMB port 445)."
  type        = list(string)
  default     = []
}

variable "allowed_cidr_blocks" {
  description = "CIDR blocks permitted to mount the filesystem (SMB port 445). Use sparingly — prefer SG references."
  type        = list(string)
  default     = []
}

# Storage ----------------------------------------------------------------------

variable "storage_capacity_gb" {
  description = "Storage capacity in GiB. Minimum 32 for SSD, 2000 for HDD."
  type        = number
}

variable "storage_type" {
  description = "Storage type: SSD or HDD."
  type        = string
  default     = "SSD"

  # HDD is only supported with MULTI_AZ_1 and SINGLE_AZ_2 at >= 2000 GiB.
  validation {
    condition     = contains(["SSD", "HDD"], var.storage_type)
    error_message = "storage_type must be 'SSD' or 'HDD'."
  }
}

variable "throughput_capacity_mbps" {
  description = <<-EOT
    Throughput capacity in MB/s. Must be one of the FSx-valid values:
    8, 16, 32, 64, 128, 256, 512, 1024, 2048.
  EOT
  type        = number

  validation {
    condition     = contains([8, 16, 32, 64, 128, 256, 512, 1024, 2048], var.throughput_capacity_mbps)
    error_message = "throughput_capacity_mbps must be one of: 8, 16, 32, 64, 128, 256, 512, 1024, 2048."
  }
}

# Deployment -------------------------------------------------------------------

variable "deployment_type" {
  description = "FSx deployment type: SINGLE_AZ_2 or MULTI_AZ_1."
  type        = string
  default     = "MULTI_AZ_1"

  validation {
    condition     = contains(["SINGLE_AZ_2", "MULTI_AZ_1"], var.deployment_type)
    error_message = "deployment_type must be 'SINGLE_AZ_2' or 'MULTI_AZ_1'."
  }
}

variable "preferred_subnet_id" {
  description = <<-EOT
    Preferred subnet ID for the primary file server in MULTI_AZ_1 deployments.
    Defaults to the first entry in subnet_ids if not explicitly provided.
    Ignored for SINGLE_AZ_2.
  EOT
  type        = string
  default     = null
}

# Active Directory -------------------------------------------------------------

variable "active_directory" {
  description = <<-EOT
    Self-managed Active Directory configuration.
    Credentials (username, password) must be sourced from Secrets Manager or SSM
    by the caller — pass resolved strings, never literals in tfvars.
  EOT
  type = object({
    domain_name                            = string
    dns_ips                                = list(string)
    username                               = string
    password                               = string
    organizational_unit_distinguished_name = optional(string)
    file_system_administrators_group       = optional(string, "Domain Admins")
  })
}

# Encryption -------------------------------------------------------------------

variable "kms_key_id" {
  description = "KMS key ARN for at-rest encryption. Omit to use the AWS-managed key (aws/fsx)."
  type        = string
  default     = null
}

# Backups ----------------------------------------------------------------------

variable "automatic_backup_retention_days" {
  description = "Number of days to retain automatic backups. 0 disables backups."
  type        = number
  default     = 7

  validation {
    condition     = var.automatic_backup_retention_days >= 0 && var.automatic_backup_retention_days <= 90
    error_message = "automatic_backup_retention_days must be between 0 and 90."
  }
}

variable "daily_automatic_backup_start_time" {
  description = "Daily backup window in HH:MM format (UTC). Example: '02:00'."
  type        = string
  default     = "02:00"

  validation {
    condition     = can(regex("^([01]\\d|2[0-3]):[0-5]\\d$", var.daily_automatic_backup_start_time))
    error_message = "daily_automatic_backup_start_time must be in HH:MM format (UTC), e.g. '02:00'."
  }
}

variable "copy_tags_to_backups" {
  description = "Whether to copy module tags to automatic and manual backups."
  type        = bool
  default     = true
}

# Maintenance ------------------------------------------------------------------

variable "weekly_maintenance_start_time" {
  description = <<-EOT
    Weekly maintenance window in 'd:HH:MM' format (UTC).
    d = day of week: 1 (Mon) through 7 (Sun). Example: '7:03:00' = Sunday 03:00 UTC.
  EOT
  type        = string
  default     = "7:03:00"

  validation {
    condition     = can(regex("^[1-7]:([01]\\d|2[0-3]):[0-5]\\d$", var.weekly_maintenance_start_time))
    error_message = "weekly_maintenance_start_time must be in 'd:HH:MM' format, e.g. '7:03:00'."
  }
}

# Aliases ----------------------------------------------------------------------

variable "dns_aliases" {
  description = "List of DNS alias FQDNs to associate with the filesystem."
  type        = list(string)
  default     = []
}

# Audit ------------------------------------------------------------------------

variable "audit_log_destination_arn" {
  description = <<-EOT
    ARN of the CloudWatch Logs log group or Kinesis Firehose delivery stream
    to receive FSx audit logs. Null disables audit logging.
  EOT
  type        = string
  default     = null
}

variable "file_access_audit_log_level" {
  description = "Audit level for file access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE."
  type        = string
  default     = "DISABLED"

  validation {
    condition     = contains(["DISABLED", "SUCCESS_ONLY", "FAILURE_ONLY", "SUCCESS_AND_FAILURE"], var.file_access_audit_log_level)
    error_message = "file_access_audit_log_level must be one of: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE."
  }
}

variable "file_share_access_audit_log_level" {
  description = "Audit level for file share access events: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE."
  type        = string
  default     = "DISABLED"

  validation {
    condition     = contains(["DISABLED", "SUCCESS_ONLY", "FAILURE_ONLY", "SUCCESS_AND_FAILURE"], var.file_share_access_audit_log_level)
    error_message = "file_share_access_audit_log_level must be one of: DISABLED, SUCCESS_ONLY, FAILURE_ONLY, SUCCESS_AND_FAILURE."
  }
}