# Sensitive variables — injected via TF_VAR_* environment variables (GitHub Secrets).
# Never put values for these in any .tf file.

variable "radius_secret" {
  type        = string
  sensitive   = true
  default     = null
  description = "RADIUS shared secret. Pass via TF_VAR_radius_secret (GitHub Secret: RADIUS_SECRET)."
}

variable "wifi_password_psk" {
  type        = string
  sensitive   = true
  description = "PSK Wi-Fi password. Pass via TF_VAR_wifi_password_psk (GitHub Secret: WIFI_PASSWORD_PSK)."
}