output "instance_id" {
  description = "OCI relay instance OCID."
  value       = oci_core_instance.relay.id
}

output "compartment_id" {
  description = "OCI relay compartment OCID."
  value       = local.compartment_id
}

output "availability_domain" {
  description = "Availability domain used by relay and image-builder instances."
  value       = data.oci_identity_availability_domains.available.availability_domains[var.availability_domain_index].name
}

output "base_image_ocid" {
  description = "Pinned Oracle Linux platform image used to build relay images."
  value       = var.image_ocid
}

output "relay_network_security_group_id" {
  description = "NSG attached to the relay instance."
  value       = oci_core_network_security_group.relay.id
}

output "image_builder_network_security_group_id" {
  description = "Operator-restricted NSG attached only to temporary image builders."
  value       = oci_core_network_security_group.image_builder.id
}

output "relay_subnet_id" {
  description = "Subnet used by relay and temporary image-builder instances."
  value       = oci_core_subnet.relay.id
}

output "public_ip" {
  description = "Reserved public IPv4 address used by DNS, WireGuard, and OPNsense aliases."
  value       = oci_core_public_ip.relay.ip_address
}

output "wireguard_listen_port" {
  description = "Public UDP listen port used by WireGuard and OPNsense."
  value       = var.wireguard_listen_port
}

output "relay_tunnel_address" {
  description = "OCI WireGuard transfer address."
  value       = var.relay_tunnel_address
}

output "relay_metrics_port" {
  description = "TCP port for metrics on the OCI WireGuard interface."
  value       = var.relay_metrics_port
}

output "home_tunnel_address" {
  description = "Home WireGuard transfer address."
  value       = local.home_tunnel_address
}

output "gateway_relay_address" {
  description = "Gateway R address targeted by OCI DNAT."
  value       = var.gateway_relay_address
}

output "wireguard_seed_secret_id" {
  description = "OCI Vault secret OCID containing the relay WireGuard seed."
  value       = oci_vault_secret.wireguard_seed.id
}

output "wireguard_public_key_secret_id" {
  description = "OCI Vault secret OCID where bootstrap publishes the relay WireGuard public key."
  value       = oci_vault_secret.wireguard_public_key.id
}

output "log_ingest_secret_id" {
  description = "OCI Vault secret OCID containing the relay log ingestion credential."
  value       = oci_vault_secret.log_ingest.id
}

output "address_list_bucket_name" {
  description = "Private OCI Object Storage bucket containing validated relay address lists."
  value       = oci_objectstorage_bucket.address_lists.name
}

output "object_storage_namespace" {
  description = "OCI Object Storage namespace used by the admission publisher."
  value       = data.oci_objectstorage_namespace.relay.namespace
}

output "admission_publisher_user_id" {
  description = "Dedicated in-cluster admission publisher user OCID."
  value       = try(oci_identity_user.admission_publisher[0].id, null)
}

output "admission_publisher_fingerprint" {
  description = "Fingerprint of the dedicated admission publisher API key."
  value       = try(oci_identity_api_key.admission_publisher[0].fingerprint, null)
}

output "smtp_deny_publisher_user_id" {
  description = "Dedicated SMTP deny publisher user OCID."
  value       = try(oci_identity_user.smtp_deny_publisher[0].id, null)
}

output "smtp_deny_publisher_fingerprint" {
  description = "Fingerprint of the dedicated SMTP deny publisher API key."
  value       = try(oci_identity_api_key.smtp_deny_publisher[0].fingerprint, null)
}

output "wan_controller_user_id" {
  description = "Dedicated WAN controller user OCID."
  value       = oci_identity_user.wan_controller.id
}

output "wan_controller_fingerprint" {
  description = "Fingerprint of the WAN controller API key."
  value       = oci_identity_api_key.wan_controller.fingerprint
}

output "wireguard_security_rule_id" {
  description = "WireGuard ingress rule identifier reconciled by the WAN controller."
  value       = oci_core_network_security_group_security_rule.wireguard.id
}

output "relay_http_monitor_id" {
  description = "OCI Health Checks monitor OCID for relay TCP port 80 reachability."
  value       = oci_health_checks_ping_monitor.relay_http.id
}

output "relay_https_monitor_id" {
  description = "OCI Health Checks monitor OCID for the relay HTTPS path."
  value       = oci_health_checks_http_monitor.relay_https.id
}

output "relay_mail_https_monitor_id" {
  description = "OCI Health Checks monitor OCID for Stalwart user HTTPS."
  value       = try(oci_health_checks_http_monitor.relay_mail_https[0].id, null)
}

output "email_dkim_dns_name" {
  description = "DNS owner name required for OCI Email Delivery DKIM."
  value       = oci_email_dkim.quorate_dev.dns_subdomain_name
}

output "email_dkim_cname_target" {
  description = "DNS CNAME target required for OCI Email Delivery DKIM."
  value       = oci_email_dkim.quorate_dev.cname_record_value
}

output "email_smtp_endpoint" {
  description = "Regional OCI Email Delivery SMTP submission endpoint."
  value       = data.oci_email_configuration.relay.smtp_submit_endpoint
}

output "email_smtp_user_id" {
  description = "Dedicated IAM user OCID for out-of-band SMTP credential provisioning."
  value       = oci_identity_user.stalwart_email_delivery.id
}