output "eip_public_ip" {
  description = "Public IP of the host's Elastic IP — the address DNS records point at."
  value       = aws_eip.host.public_ip
}

output "instance_id" {
  description = "EC2 instance id of the host."
  value       = aws_instance.host.id
}

output "security_group_id" {
  description = "Security group id of the host — useful for sibling services that admit traffic from the fleet only."
  value       = aws_security_group.host.id
}

output "role_arn" {
  description = "ARN of the host IAM role."
  value       = aws_iam_role.host.arn
}

output "role_name" {
  description = "Name of the host IAM role."
  value       = aws_iam_role.host.name
}

output "ami_id" {
  description = "Resolved AMI id (most recent matching image) — reusable by sibling boxes in the same root."
  value       = data.aws_ami.debian_arm64.id
}

output "store_user_boundary_arn" {
  description = "ARN of the permissions boundary store users are created under. Set it as CARLOS_STORE_USER_BOUNDARY on the console, which refuses to boot with a storage backend and no boundary. Null when store_bucket_prefix is empty."
  value       = var.store_bucket_prefix == "" ? null : aws_iam_policy.store_user_boundary[0].arn
}

output "vpc_cidr" {
  description = "CIDR of the VPC the host lives in — the value for CARLOS_RELAY_DENY_CIDRS on a box that runs the relay."
  value       = data.aws_vpc.host.cidr_block
}

output "termination_queue_url" {
  description = "The queue that receives this region's EC2 terminated events."
  value       = aws_sqs_queue.terminations.id
}