locals {
  # SSH Public Key for Provisioning
  ssh_key = var.use_vault ? data.vault_kv_secret_v2.vm_creds[0].data["ssh_public_key"] : var.ssh_public_key
  
  # CI Credentials
  ci_user     = var.use_vault ? data.vault_kv_secret_v2.vm_creds[0].data["ci_user"] : var.ci_user
  ci_password = var.use_vault ? data.vault_kv_secret_v2.vm_creds[0].data["ci_password"] : var.ci_password

  vms = {
    # VLAN 30: Docker
    "vm-docker-mailcow-300" = { id = 300, cores = 4, memory = 8192, vlan = 30, tags = "docker,mailcow", ip = "10.100.30.10", gw = "10.100.30.1" }
    "vm-docker-apps-301"    = { id = 301, cores = 2, memory = 4096, vlan = 30, tags = "docker,apps",    ip = "10.100.30.11", gw = "10.100.30.1" }
    # vm-docker-traefik-302 entfernt (Traefik Edge läuft jetzt im k3s Cluster)

    # VLAN 40: K3s (HA Control Plane)
    "vm-k3s-master-400"     = { id = 400, cores = 4, memory = 16000, vlan = 40, tags = "k3s,master",     ip = "10.100.40.10", gw = "10.100.40.1" }
    "vm-k3s-master-401"     = { id = 401, cores = 4, memory = 16000, vlan = 40, tags = "k3s,master",     ip = "10.100.40.11", gw = "10.100.40.1" }
    "vm-k3s-master-402"     = { id = 402, cores = 4, memory = 16000, vlan = 40, tags = "k3s,master",     ip = "10.100.40.12", gw = "10.100.40.1" }

    # VLAN 90: Bastion
    "vm-bastion-900"        = { id = 900, cores = 1, memory = 2048, vlan = 90, tags = "bastion",        ip = "10.100.90.10", gw = "10.100.90.1" }
    "vm-bastion-901"        = { id = 901, cores = 1, memory = 2048, vlan = 90, tags = "bastion",        ip = "10.100.90.11", gw = "10.100.90.1" }
  }

  # Extra DNS entries for VIPs (Virtual IPs)
  extra_dns = {
    "k3s-api"     = { ip = "10.100.40.5", tags = "k3s,vip,api" }
    "k3s-ingress" = { ip = "10.100.40.6", tags = "k3s,vip,ingress" }
  }
}