snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

terraform/modules/security/variables.tf

@@ -0,0 +1,89 @@
+# =============================================================================
+# SeaweedFS security material generator (cloud-agnostic).
+#
+# Generates the CA, per-component mTLS certs with DISTINCT CommonNames, and JWT
+# signing keys. Outputs a `core_security` object ready to feed the core module's
+# `security` variable, plus the raw PEMs for a wrapper to deliver via a secret
+# store. NOTE: TF-generated secrets live in state; prefer Vault PKI for the CA
+# in production.
+# =============================================================================
+
+variable "internal_domain" {
+  description = "Internal domain for component CNs (e.g. master.<domain>). Drives the allowed_wildcard_domain peer-auth check."
+  type        = string
+  default     = "seaweedfs.internal"
+}
+
+variable "ip_sans" {
+  description = "IP addresses to include as SANs on every component cert (all node private IPs + 127.0.0.1 is added automatically)."
+  type        = list(string)
+  default     = []
+}
+
+variable "extra_dns_sans" {
+  description = "Additional DNS SANs to include on every component cert."
+  type        = list(string)
+  default     = []
+}
+
+variable "key_algorithm" {
+  description = "CA/leaf key algorithm: ECDSA (default, modern) or RSA."
+  type        = string
+  default     = "ECDSA"
+  validation {
+    condition     = contains(["ECDSA", "RSA"], var.key_algorithm)
+    error_message = "key_algorithm must be ECDSA or RSA."
+  }
+}
+
+variable "ecdsa_curve" {
+  description = "ECDSA curve when key_algorithm = ECDSA."
+  type        = string
+  default     = "P256"
+}
+
+variable "rsa_bits" {
+  description = "RSA key size when key_algorithm = RSA."
+  type        = number
+  default     = 3072
+}
+
+variable "ca_validity_hours" {
+  description = "CA certificate validity (default 10 years)."
+  type        = number
+  default     = 87600
+}
+
+variable "cert_validity_hours" {
+  description = "Component certificate validity. Short by default; certs hot-reload so reissue is cheap."
+  type        = number
+  default     = 72
+}
+
+variable "cert_early_renewal_hours" {
+  description = "Renew component certs this many hours before expiry."
+  type        = number
+  default     = 24
+}
+
+variable "cert_dir" {
+  description = "On-host directory where certs are placed; surfaced in core_security.cert_dir."
+  type        = string
+  default     = "/usr/local/share/ca-certificates"
+}
+
+variable "generate_jwt" {
+  description = "Generate JWT signing keys (signing, signing.read, filer_signing, filer_signing.read)."
+  type        = bool
+  default     = true
+}
+
+variable "jwt_length" {
+  description = "Length of generated JWT keys (>= 32 hardened)."
+  type        = number
+  default     = 40
+  validation {
+    condition     = var.jwt_length >= 32
+    error_message = "jwt_length must be >= 32 (hardened minimum)."
+  }
+}