# Definición de la Organización
variable "organization_name" {
  type        = string
  description = "Nombre exacto de tu organización en el Dashboard de Meraki"
}

# Definición de la Red
variable "network_name" {
  type        = string
  description = "Nombre de la red (Network) donde reside el switch"
}


# Reglas de firewall L3
variable "firewall_rules" {
  type = list(object({
    comment        = string
    policy         = string
    protocol       = string
    src_cidr       = string
    src_port       = string
    dest_cidr      = string
    dest_port      = string
    syslog_enabled = optional(bool, false)
  }))
  default     = []
  description = "Lista de reglas de firewall L3 para el site"
}

# SSIDs wireless
variable "wireless_ssids" {
  type = list(object({
    number              = number
    name                = string
    enabled             = optional(bool, true)
    auth_mode           = string
    splash_page         = optional(string, "None")
    wpa_encryption_mode = optional(string, "WPA3 only")
    ip_assignment_mode  = optional(string, "Bridge mode")
    use_vlan_tagging    = optional(bool, false)
    default_vlan_id     = optional(number, null)
    redirect_url        = optional(string, "")
    radius_servers = optional(list(object({
      host = string
      port = number
    })), [])
  }))
  default     = []
  description = "Lista de SSIDs wireless a configurar en el site"
}

# Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
variable "radius_secret" {
  type        = string
  sensitive   = true
  default     = ""
  description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
}

# Definición de VLANs
variable "switch_vlans" {
  type = map(object({
    name          = string
    subnet        = string
    appliance_ip  = string
    dhcp_handling = optional(string, "Run a DHCP server")
    reserved_ip_ranges = optional(list(object({
      comment = string
      id      = string
      start   = string
      end     = string
    })), [])
  }))
  description = "Mapa de configuraciones de VLAN. La clave del mapa será el ID de la VLAN"
}


# Políticas de acceso 802.1X para switches
variable "switch_access_policies" {
  type = list(object({
    name                               = string
    access_policy_type                 = optional(string, "802.1x")
    host_mode                          = optional(string, "Multi-Auth")
    radius_accounting_enabled          = optional(bool, false)
    radius_testing_enabled             = optional(bool, false)
    radius_coa_support_enabled         = optional(bool, false)
    radius_failed_auth_vlan_id         = optional(number, null)
    radius_re_authentication_interval  = optional(number, 0)
    url_redirect_walled_garden_enabled = optional(bool, false)
    radius_servers = list(object({
      host = string
      port = number
    }))
  }))
  default     = []
  description = "Políticas de acceso 802.1X para switches MS"
}

# Configuración de puertos de switch
variable "switch_port_configs" {
  type = list(object({
    serial               = string
    port_id              = string
    name                 = optional(string, "")
    type                 = optional(string, "access")
    vlan                 = optional(number, null)
    voice_vlan_id        = optional(number, null)
    access_policy_type   = optional(string, "Open")
    access_policy_number = optional(number, null)
  }))
  default     = []
  description = "Puertos de switch a configurar con 802.1X. Requiere serial del switch."
}