terraform {
  required_version = "< 2.0.0"
  backend "pg" {
    conn_str    = "postgres://10.234.158.153:5432/tf_state?sslmode=require"
    schema_name = "internal_vault"
  }

  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.8"
    }
  }
}

# VAULT_ADDR and VAULT_TOKEN are read from the environment.
provider "vault" {}

provider "random" {}

variable "cluster_domain" {
  description = "Internal cluster domain suffix used for Tier I TLS certificates."
  type        = string
  default     = "cluster.local"
}

variable "internal_domain" {
  description = "Public domain used for Tier I services (e.g. example.com). Vault PKI will allow this as a SAN."
  type        = string
  default     = "quorate.internal"
}

variable "k8s_host" {
  description = "Kubernetes API server URL for the Vault Kubernetes auth method."
  type        = string
  default     = "https://kubernetes.default.svc"
}