# terraform.tfvars.example — generated by `autumn release init --target azure-container-apps`
# Copy to terraform.tfvars and edit the non-secret values below.
# WARNING: Never commit real credentials — pass secrets as TF_VAR_* env vars
# or through your CI's secret store instead of writing them into this file.
app_name = "{{project_name}}"
location = "eastus"
image_tag = "latest"
db_sku = "B_Standard_B1ms"
# subscription_id required by AzureRM v4 — find yours:
# az account show --query id -o tsv
subscription_id = "00000000-0000-0000-0000-000000000000"
# bootstrap_image = "mcr.microsoft.com/k8se/quickstart:latest" # keep min_replicas = 0 until your real image is deployed
min_replicas = 0
max_replicas = 10
enable_redis_cache = false
# ── Secrets — set these out-of-band, never as literals in this file ────────
# There is no database_url variable to set: main.tf derives the connection
# string from the Postgres server this same apply creates.
#
# export TF_VAR_database_admin_password="$(openssl rand -base64 18)Aa1!"
# export TF_VAR_signing_secret="$(openssl rand -hex 32)"
#
# database_admin_password must satisfy Azure's Postgres complexity policy —
# 3 of {uppercase, lowercase, digit, symbol}. `openssl rand -hex` only ever
# produces lowercase hex digits (2 of 4 categories), and even `-base64`
# alone only samples its alphabet randomly — a small fraction of outputs
# could still land on just 2 categories (e.g. all upper+lowercase, no
# digit). Appending a fixed "Aa1!" guarantees all 4 categories are present
# regardless of what the random portion contains, rather than relying on
# probability.
# signing_secret has no such constraint — hex is fine there.
#
# database_admin_password = (set via TF_VAR_database_admin_password)
# signing_secret = (set via TF_VAR_signing_secret)