# `buckets` contract is byte-identical to modules/yc-s3 so a single declaration in
# infrastructure.yaml drives both the Yandex Object Storage and the in-cluster
# MinIO backend. YC-only fields (versioning/cors) are accepted for schema parity;
# MinIO applies what it supports (versioning) and ignores the rest.

variable "buckets" {
  description = "List of S3 buckets to create"
  type = list(object({
    name = string
    acl  = optional(string, "private")
    role = optional(string, null)
    versioning = optional(object({
      enabled = bool
    }), { enabled = false })
    cors = optional(object({
      enabled         = optional(bool, false)
      allowed_headers = optional(list(string), [])
      allowed_methods = optional(list(string), [])
      allowed_origins = optional(list(string), [])
      expose_headers  = optional(list(string), [])
      max_age_seconds = optional(number, 3600)
    }), { enabled = false })
  }))
}

variable "user_suffix" {
  description = "Suffix for the per-bucket MinIO access user (access_key = <bucket><suffix>)."
  type        = string
  default     = "-sa"
}

variable "minio_endpoint" {
  description = "MinIO S3 endpoint URL (scheme decides ssl). E.g. https://minio.contour.infra.sarex.tech"
  type        = string
}

variable "minio_user" {
  description = "MinIO admin access key."
  type        = string
  default     = ""
}

variable "minio_password" {
  description = "MinIO admin secret key."
  type        = string
  default     = ""
  sensitive   = true
}