variable "name" {
  description = "Name for the instance, its security group, its IAM role and its instance profile (e.g. \"carlos-flagship-scanner\")."
  type        = string
}

variable "ami_id" {
  description = "Debian arm64 AMI. Pass the console box's own image, module.<host>.ami_id, so the two are built from the same base. Ignored after creation: a newer image never replaces the box by itself."
  type        = string
}

variable "client_security_group_id" {
  description = "Security group of the ONE box allowed to reach clamd: the console's. clamd has no authentication at all, so this group is the whole fence. The scanner's own group is created in this group's VPC."
  type        = string
}

variable "region" {
  description = "AWS region the box runs in (e.g. \"eu-west-1\"). The SSM agent package is served per region and the box must fetch its own."
  type        = string
}

variable "instance_type" {
  description = "EC2 instance type (arm64 Graviton). clamd holds about 1.5 GB of signatures resident and briefly about twice that while reloading them, so t4g.medium is the default. A t4g.small works only with concurrent_database_reload = false."
  type        = string
  default     = "t4g.medium"
}

variable "stream_max_bytes" {
  description = "Largest object clamd accepts on a stream (StreamMaxLength), in bytes. Set the console's CARLOS_CLAMD_MAX_BYTES to this module's stream_max_bytes output: the two must be equal. Between 8 MiB and 100 MiB: the box's self-test streams fixtures of about 5 MB, and a whole stream must fit the 100 MiB scan budget."
  type        = number
  default     = 26214400
  validation {
    condition     = var.stream_max_bytes >= 8388608 && var.stream_max_bytes <= 104857600
    error_message = "stream_max_bytes must be between 8388608 (8 MiB) and 104857600 (100 MiB)."
  }
  validation {
    condition     = var.stream_max_bytes % 1048576 == 0
    error_message = "stream_max_bytes must be a whole number of MiB (a multiple of 1048576), because clamd.conf holds it in M."
  }
}

variable "memory_max" {
  description = "clamd's cgroup ceiling (systemd MemoryMax). Under memory pressure the kernel kills clamd, never the SSM agent that is the only way onto the box."
  type        = string
  default     = "3G"
}

variable "memory_high" {
  description = "clamd's throttle point (systemd MemoryHigh), about 85% of memory_max."
  type        = string
  default     = "2560M"
}

variable "concurrent_database_reload" {
  description = "Keep scanning while freshclam's new signatures load, at the cost of holding both databases in memory at once. False pauses scanning during each reload and fits a smaller box."
  type        = bool
  default     = true
}

variable "subnet_id" {
  description = "Subnet to launch in. Null (the default) is the default subnet of the default VPC, and is refused unless the client security group lives in the default VPC. The subnet needs a route to the internet: the box fetches signatures and packages."
  type        = string
  default     = null
}