autumn-cli 0.7.0

# variables.tf — generated by `autumn release init --target aws-ecs`

variable "app_name" {
  description = "Name used to prefix every provisioned AWS resource."
  type        = string
  default     = "{{project_name}}"
}

variable "region" {
  description = "AWS region for all resources."
  type        = string
  default     = "us-east-1"
}

variable "vpc_cidr" {
  description = "CIDR block for the VPC (2 public + 2 private subnets are carved out of it across 2 AZs)."
  type        = string
  default     = "10.0.0.0/16"
}

# The ALB's ACM certificate is DNS-validated against this hosted zone, and
# an alias A record pointing domain_name at the ALB is created in it — the
# zone must already be the domain's live DNS (delegated at your registrar)
# before `terraform apply`, or certificate validation will hang until it
# times out.
variable "domain_name" {
  description = "Domain name the ALB serves over HTTPS (e.g. \"app.example.com\"). Must be within route53_zone_id."
  type        = string
}

variable "route53_zone_id" {
  description = "Route 53 hosted zone ID that already owns domain_name's DNS — find yours with `aws route53 list-hosted-zones-by-name --dns-name <your-domain> --query \"HostedZones[0].Id\" --output text`."
  type        = string
}

variable "image_tag" {
  description = "Tag of the {{project_name}} image in ECR to deploy. Documents the tag scheme used by aws-deploy.yml/the manual walkthrough after bootstrap — Terraform itself only ever sets `bootstrap_image` (see below) and never manages the image after the first apply."
  type        = string
  default     = "latest"
}

# ECS Fargate must pull an image to register a task definition's first
# revision, but a brand-new ECR repository has none yet — so Terraform
# points both the "app" and "migrate" task definitions at this public
# placeholder on the first apply, then ignores further container definition
# drift (see the `lifecycle.ignore_changes` blocks in main.tf) once
# aws-deploy.yml/the manual walkthrough take over registering revisions
# with the real image. Deliberately plain nginx, not e.g. AWS's own
# hello-app-runner quickstart image: the "app" task's container definition
# (main.tf) overrides its entrypoint/command to listen on port 3000 and
# serve /health, matching the ALB target group's fixed health check — an
# image whose default listening port isn't a well-known, documented
# constant would leave the bootstrap revision permanently unhealthy.
variable "bootstrap_image" {
  description = "Public placeholder image Terraform uses to register the ECS task definitions before any real image has been pushed to ECR. If you change this for the \"app\" family, keep main.tf's entryPoint/command override (or an equivalent) so it still listens on port 3000 and serves 200 on /health."
  type        = string
  default     = "public.ecr.aws/nginx/nginx:latest"
}

variable "cpu" {
  description = "Fargate task vCPU units (256 = .25 vCPU, 1024 = 1 vCPU, ...) — see AWS's Fargate CPU/memory table for valid cpu+memory pairs."
  type        = string
  default     = "512"
}

variable "memory" {
  description = "Fargate task memory in MiB — must pair validly with `cpu` per AWS's Fargate CPU/memory table."
  type        = string
  default     = "1024"
}

variable "db_instance_class" {
  description = "RDS instance class for the Postgres database."
  type        = string
  default     = "db.t4g.micro"
}

# ── Scale config defaults ────────────────────────────────────────────────────
# Desired: 2, Min: 1, Max: 10. Application Auto Scaling (main.tf) scales the
# ECS service between min_count and max_count on CPU/memory target tracking.

variable "desired_count" {
  description = "Number of Fargate tasks the ECS service starts with."
  type        = number
  default     = 2
}

variable "min_count" {
  description = "Minimum number of Fargate tasks Application Auto Scaling keeps running."
  type        = number
  default     = 1
}

variable "max_count" {
  description = "Maximum number of Fargate tasks Application Auto Scaling scales up to."
  type        = number
  default     = 10
}

variable "enable_redis_cache" {
  description = "Provision an optional ElastiCache Redis replication group and wire its URL into the app. Infrastructure only: your app must ALSO depend on the autumn-cache-redis crate and register RedisCachePlugin in main.rs for this to take effect — see docs/guide/cloud-native.md. Off by default to avoid the extra cost."
  type        = bool
  default     = false
}

# ── Secrets — no default. Supply via TF_VAR_* env vars or your CI's secret
# store. Never commit real values in terraform.tfvars. ──────────────────────
#
# Note: there is no `database_url` variable. A single `terraform apply` must
# succeed without a second, targeted apply to fill in a value that depends on
# a resource the same apply is about to create — so main.tf derives the full
# connection string from `aws_db_instance.this`'s address plus this password,
# rather than requiring the operator to pre-compute it.

variable "database_admin_password" {
  description = "Master password for the RDS PostgreSQL instance."
  type        = string
  sensitive   = true
}

variable "signing_secret" {
  description = "Signing secret stored in Secrets Manager as AUTUMN_SECURITY__SIGNING_SECRET; generate with `openssl rand -hex 32`."
  type        = string
  sensitive   = true
}