variables.tf

#  Feature Toggles
variable deploy_api_gateway {
  description                  = "Whether to deploy API Management"
  default                      = false
  type                         = bool
}

variable deploy_managed_bastion {
  description                  = "Whether to deploy the Managed Bastion"
  default                      = false
  type                         = bool
}

variable deploy_monitoring_vm_extensions {
  description                  = "Whether to deploy optional monitoring VM extensions"
  default                      = false
  type                         = bool
}
variable deploy_network_watcher {
  description                  = "Whether to deploy connection monitors"
  default                      = false
  type                         = bool
}
variable deploy_non_essential_vm_extensions {
  description                  = "Whether to deploy optional VM extensions"
  default                      = false
  type                         = bool
}
variable deploy_security_vm_extensions {
  description                  = "Whether to deploy optional security VM extensions"
  default                      = false
  type                         = bool
}
variable deploy_vpn {
  description                  = "Whether to deploy the point to Site VPN"
  default                      = false
  type                         = bool
}
variable disable_public_database_access {
  description                  = "Disables the public IP address of SQL Database, regardless of any SQL Firewall rules"
  default                      = true
  type                         = bool
}
variable enable_app_service_aad_auth {
  description                  = "Whether to enable App Service AAD auth"
  default                      = false
  type                         = bool
}
variable enable_auto_shutdown {
  description                  = "Whether to enable Auto Shutdown of VM's"
  default                      = true
  type                         = bool
}
variable enable_custom_vulnerability_baseline {
  description                  = "Whether to create a customozied baseline in line with created infrastructure"
  default                      = false
  type                         = bool
}
variable enable_storage_diagnostic_setting {
  description                  = "Whether to enable Log Analytics diagnostics settings for storage accounts"
  default                      = false
  type                         = bool
}
variable enable_private_link {
  description                  = "Whether to create Private Endpoint for PaaS services where possible"
  default                      = true
  type                         = bool
}
variable grant_database_access {
  description                  = "App Service MSI access to SQL Database (required for application deployment)"
  default                      = false
  type                         = bool
}
variable restrict_public_access {
  description                  = "Implements network rules on PaaS Firewalls"
  default                      = false
  type                         = bool
}
variable use_pipeline_environment {
  description                  = "Use environment rather than deployment group for Pipeline Agent"
  default                      = true
  type                         = bool
}
variable use_server_side_disk_encryption {
  description                  = "Use server-side disk encryption (false = client side encryption)"
  default                      = false
  type                         = bool
}
variable use_vanity_domain_and_ssl {
  description                  = "Whether to use SSL (HTTPS) for demo application"
  default                      = false
  type                         = bool
}

## Regular variables
variable resource_prefix {
  description                  = "The prefix to put in front of resource names created"
  default                      = "vdc"
}

variable resource_suffix {
  description                  = "The suffix to put at the of resource names created"
  default                      = "" # Empty string triggers a random suffix
}

variable deployment_name {
  description                  = "The middle part of the of the resource names created"
  default                      = "" # Empty string defaults to workspace name
}

# https://azure.microsoft.com/en-us/global-infrastructure/regions/
# https://azure.microsoft.com/en-us/global-infrastructure/services/?products=monitor,azure-bastion,private-link
variable location {
  description                  = "The location/region where the virtual network is created. Changing this forces a new resource to be created."
  # These are examples of regions that support all features:
  # eastus, northeurope, southeastasia, uksouth, westeurope, westus2
  default                      = "uksouth"
}

variable tags {
  description                  = "A map of the tags to use for the resources that are deployed"
  type                         = map

  default = {
    shutdown                   = "true"
  }
} 

variable alert_email {
  description                  = "The email adres alerts for the created action group are sent to"
  default                      = null
}
variable backend_storage_account {
  description                  = "The storage account name used for the Terraform azurerm backend. This is used for data source terraform_remote_state"
  default                      = null
}

variable build_id {
  description                  = "The ID of the Build Pipeline that deployed this resource, or created the artefacts"
  default                      = "" 
}

variable release_web_url {
  description                  = "The url of the Release Pipeline that deployed this resource"
  default                      = "" 
}
variable release_id {
  description                  = "The ID of the Release Pipeline that deployed this resource"
  default                      = ""
}
variable release_user_email {
  description                  = "The email address of the user that triggered the pipeline that deployed this resource"
  default                      = ""
}
variable vso_url {
  description                  = "The url of the Visual Studio Online environment used (if any)"
  default                      = ""
}

variable apim_aad_client_id {
  description                  = "Client (Service Principal) ID used for AAD Identity integration"  
  default                      = null
}
variable apim_aad_client_secret {
  description                  = "Client (Service Principal) Secret used for AAD Identity integration"  
  default                      = null
}

variable apim_notification_sender_email {
  default                      = "noreply@nowhere.com"
}

variable apim_control_plane_ip_addresses {
# List of IP addresses: https://docs.microsoft.com/en-us/azure/api-management/api-management-using-with-vnet#--control-plane-ip-addresses
# Get-AzOperationalInsightsIntelligencePack
  default                      = [
    "104.214.19.224",
    "52.162.110.80",
    "52.253.135.58",
    "40.82.157.167",
    "51.137.136.0",
    "40.81.185.8",
    "40.81.47.216",
    "51.145.56.125",
    "40.81.89.24",
    "52.224.186.99",
    "51.145.179.78",
    "52.140.238.179",
    "40.66.60.111",
    "52.139.80.117",
    "20.46.144.85",
    "191.233.24.179",
    "40.90.185.46",
    "102.133.130.197",
    "52.139.20.34",
    "40.80.232.185",
    "13.71.49.1",
    "13.64.39.16",
    "20.40.160.107",
    "20.37.52.67",
    "20.44.33.246",
    "13.86.102.66",
    "20.40.125.155",
    "51.143.127.203",
    "52.253.229.253",
    "52.253.159.160",
    "20.188.77.119",
    "20.44.72.3",
    "52.142.95.35",
    "52.139.152.27",
    "20.39.80.2",
    "51.107.96.8",
    "20.39.99.81",
    "20.37.81.41",
    "51.107.0.91",
    "102.133.0.79",
    "51.116.96.0",
    "51.116.0.0",
    "51.120.2.185",
    "51.120.130.134",
    "139.217.51.16",
    "139.217.171.176",
    "40.125.137.220",
    "40.126.120.30",
    "40.73.41.178",
    "40.73.104.4",
    "52.127.42.160",
    "52.127.34.192",
    "52.227.222.92",
    "13.73.72.21",
    "52.244.32.39",
    "52.243.154.118",
    "52.182.32.132",
    "52.181.32.192",
  ]
}

# https://docs.microsoft.com/en-us/azure/automation/how-to/region-mappings
variable automation_location {
  description                  = "The location/region where the monitoring workspaces will be created."
  default                      = "" # Empty string defaults to workspace_location
}

variable workspace_location {
  description                  = "The location/region where the monitoring workspaces will be created."
  default                      = "" # Empty string defaults to location
}

variable vdc_config {
  type                         = map

  default = {
    vdc_range                  = "10.0.0.0/14"
    hub_range                  = "10.0.0.0/16"
    hub_apim_subnet            = "10.0.5.0/27"
    hub_bastion_subnet         = "10.0.255.192/27"
    hub_iag_subnet             = "10.0.0.0/26"
    hub_mgmt_subnet            = "10.0.2.128/26"
    hub_paas_subnet            = "10.0.4.0/26"
    hub_vpn_subnet             = "10.0.3.224/27"
    hub_waf_subnet             = "10.0.1.64/26"
    iaas_spoke_range           = "10.1.0.0/16"
    iaas_spoke_bastion_subnet  = "10.1.255.192/27"
    iaas_spoke_app_subnet      = "10.1.1.0/24"
    iaas_spoke_data_subnet     = "10.1.2.0/24"
    iaas_spoke_app_web_lb_address = "10.1.1.4"
    iaas_spoke_app_db_lb_address = "10.1.2.4"
    paas_spoke_range           = "10.2.0.0/16"
    paas_spoke_bastion_subnet  = "10.2.255.192/27"
    paas_spoke_app_subnet      = "10.2.3.0/24"
    paas_spoke_appsvc_subnet   = "10.2.1.0/24"
    paas_spoke_data_subnet     = "10.2.2.0/24"

    vpn_range                  = "192.168.0.0/24"

    hub_mgmt_address           = "10.0.2.132"
  }
}

variable app_web_vms {
  default                      = ["10.1.1.5", "10.1.1.6", "10.1.1.7", "10.1.1.8", "10.1.1.9"]
}

variable app_db_vms {
  default                      = ["10.1.2.142", "10.1.2.143", "10.1.2.144", "10.1.2.145", "10.1.2.146"]
}

variable vdc_oms_solutions {
# List of solutions: https://docs.microsoft.com/en-us/rest/api/loganalytics/workspaces/listintelligencepacks
# Get-AzOperationalInsightsIntelligencePack
  default                      = [
  # "ADAssessment",
  # "ADReplication",
  # "AgentHealthAssessment",
  # "AlertManagement",
  # "AntiMalware",
  # "ApplicationInsights", # Depricated
  # "ASRAnalytics",
  # "AzureActivity",
  # "AzureAppGatewayAnalytics",
  # "AzureAutomation",
  # "AzureCdnCoreAnalytics",
  # "AzureDataFactoryAnalytics",
    "AzureNetworking", # Depricated
  # "AzureNSGAnalytics", # Depricated
  # "AzureSecurityOfThings",
  # "AzureSQLAnalytics",
  # "AzureWebAppsAnalytics", # Depricated
  # "Backup", # Depricated
  # "CapacityPerformance", # Not found
  # "ChangeTracking",
  # "CompatibilityAssessment",
  # "ContainerInsights",
  # "Containers",
  # "DeviceHealthProd",
  # "DHCPActivity",
  # "DnsAnalytics",
  # "HDInsight",
  # "HDInsightHadoop",
  # "HDInsightInteractiveQuery",
  # "HDInsightKafka",
  # "HDInsightSpark",
  # "HDInsightStorm",
  # "InfrastructureInsights", # Not found
  # "InternalWindowsEvent", # Not found
  # "KeyVault",
  # "KeyVaultAnalytics",
  # "LogicAppB2B",
  # "LogicAppsManagement",
  # "LogManagement",
  # "Microsoft365Analytics",
  # "NetworkMonitoring",
  # "Office365",
    "ProcessInvestigator",
  # "SCOMAssessment",
  # "Security",
    "SecurityCenterFree",
    "SecurityCenterNetworkTraffic",
  # "SecurityInsights",
  # "ServiceDesk",
  # "ServiceFabric",
    "ServiceMap",
  # "SiteRecovery",
    "SQLAdvancedThreatProtection",
  # "SQLAssessment",
  # "SQLThreatDetection",
    "SQLVulnerabilityAssessment",
  # "SurfaceHub",
    "Updates",
    "VMInsights",
  # "VMware",
  # "WaaSUpdateInsights",
  # "WEF_10x",
  # "WEF_10xDSRE",
  # "WEFInternal",
  # "WEFInternalUat",
  # "WindowsDefenderATP",
  # "WindowsDefenderATPStable",
  # "WindowsEventForwarding",
  # "WindowsFirewall",
  # "WinLog",
  # "WireData",
  # "WireData2"
  ]
}

variable admin_ip_ranges {
  default                      = []
}
variable admin_ips {
  default                      = []
}
variable admin_login {
  default                      = null
}
variable admin_object_id {
  default                      = null
}

variable rdp_port {
# default                      = 3389 # Default for protocol
  default                      = null
}

########## Credentials #########
variable admin_username {
  description                  = "The VDC admin user name"
  default                      = "vdcadmin"
}

variable app_devops {
  type                         = map

  default = {
    account                    = null
    team_project               = "VDC"
    web_deployment_group       = "AppServers"
    db_deployment_group        = "DBServers"
    pat                        = null
  }
}

variable app_storage_account_tier {
  description                  = "Defines the Tier of storage account to be created. Valid options are Standard and Premium."
  default                      = "Standard"
}

variable app_storage_replication_type {
  description                  = "Defines the Replication Type to use for this storage account. Valid options include LRS, GRS, ZRS etc."
  default                      = "ZRS" # Zone redundant: ZRS
}

variable app_web_vm_number {
  description                  = "Number of web tier VM's to create"
  default                      = "2"
}
variable app_web_vm_size {
  description                  = "Specifies the size of the Web virtual machines."
  default                      = "Standard_D2s_v3"
}
variable app_web_image_publisher {
  description                  = "name of the publisher of the Web image (az vm image list)"
  default                      = "MicrosoftWindowsServer"
}
variable app_web_image_offer {
  description                  = "the name of the offer (az vm image list)"
  default                      = "WindowsServer"
}
variable app_web_image_sku {
  description                  = "image sku to apply (az vm image list)"
  default                      = "2019-Datacenter"
}
variable app_web_image_version {
  description                  = "version of the Web image to apply (az vm image list)"
  default                      = "latest"
}

variable app_db_vm_number {
  description                  = "Number of DB tier VM's to create"
  default                      = "2"
}
variable app_db_vm_size {
  description                  = "Specifies the size of the DB virtual machines."
  default                      = "Standard_D2s_v3"
}
variable app_db_image_publisher {
  description                  = "name of the publisher of the DB image (az vm image list)"
  default                      = "MicrosoftWindowsServer"
}
variable app_db_image_offer {
  description                  = "the name of the offer (az vm image list)"
  default                      = "WindowsServer"
}
variable app_db_image_sku {
  description                  = "image sku to apply (az vm image list)"
  default                      = "2019-Datacenter"
}
variable app_db_image_version {
  description                  = "version of the DB image to apply (az vm image list)"
  default                      = "latest"
}
variable app_database_template_storage_key {
  default                      = "?st=2020-03-20T13%3A57%3A32Z&se=2023-04-12T13%3A57%3A00Z&sp=r&sv=2018-03-28&sr=c&sig=qGpAjJlpDQsq2SB6ev27VbwOtgCwh2qu2l3G8kYX4rU%3D"
}
variable paas_aad_auth_client_id_map {
  type                         = map
  default                      = null
}
variable paas_app_storage_import {
  type                         = bool
  default                      = false
}
variable paas_app_web_container {
  default                      = null
}
variable management_vm_size {
  description                  = "Specifies the size of the Management virtual machine"
  default                      = "Standard_D2s_v3"
}
variable shared_resources_group {
  description                  = "Resource group of shared (data) resources e.g. Container Registry, DNS"
  default                      = "Shared"
}
variable shared_container_registry {
  description                  = "Container Registry to deploy App Service web app from"
  default                      = null
}
variable shared_container_registry_spn_app_id {
  default                      = null
}
variable shared_container_registry_spn_secret {
  default                      = null
}
variable timezone {
  # https://jackstromberg.com/2017/01/list-of-time-zones-consumed-by-azure/
  default                      = "W. Europe Standard Time"
}
variable timezone_automation {
  default                      = "Europe/Amsterdam"
}
variable update_management_time {
  description                  = "Time of day when OS updates are scheduled (UTC)"
  default                      = "21:00"
}
variable vanity_domainname {
  description                  = "The domain part of the vanity url"
  default                      = null
}
variable vanity_certificate_name {
  description                  = "The name of the SSL certificate used for vanity url"
  default                      = null
}

variable vanity_certificate_path {
  description                  = "The relative path to the SSL certificate PFX file used for vanity url"
  default                      = null
}

variable vanity_root_certificate_cer_path {
  description                  = "The relative path to the root SSL certificate CER file used for AppGW client auth to APIM"
  default                      = null
}

variable vanity_certificate_password {
  description                  = "The password of the SSL certificate PFX file used for vanity url"
  default                      = null
}

variable vpn_root_cert_name {
  default                      = "P2SRootCert" 
}

variable vpn_root_cert_file {
  description                  = "The relative path to the certificate CER file used for P2S root"
  default                      = null
}

variable default_create_timeout {
  default                      = "60m"
}

variable default_update_timeout {
  default                      = "60m"
}

variable default_read_timeout {
  default                      = "30m"
}

variable default_delete_timeout {
  default                      = "60m"
}