userdata

type EnvVars struct {
	SSHAuthorizedKey string // SSH_AUTHORIZED_KEY
	InstanceID       string `validate:"required"` // INSTANCE_ID
	ClusterID        string `validate:"required"` // CLUSTER_ID

	// ProviderKind identifies the environment the VM is running in.
	// One of: "local", "aws", "google", "proxmox".
	ProviderKind         string `validate:"required,oneof=local aws google proxmox"` // PROVIDER_KIND
	ProviderRegion       string // PROVIDER_REGION
	ProviderZone         string // PROVIDER_ZONE
	ProviderInstanceType string // PROVIDER_INSTANCE_TYPE
	AWSAccountID         string // AWS_ACCOUNT_ID
	GoogleProjectID      string // GOOGLE_PROJECT_ID

	OIDCIssuer   string `validate:"omitempty,url"` // OIDC_ISSUER
	OIDCCustomCA string // OIDC_CUSTOM_CA
	OIDCCAFile   string // OIDC_CA_FILE

	KubeLogLevel          string `validate:"required,uintstr"` // KUBE_LOG_LEVEL
	KubeAPIPublicHostname string // KUBE_API_PUBLIC_HOSTNAME
	KubeAPIPort           string `validate:"required,portstr"` // KUBE_API_PORT
	KubeAPIEtcdServers    string // KUBE_API_ETCD_SERVERS

	NstanceCACert                 string // NSTANCE_CA_CERT
	NstanceServerRegistrationAddr string // NSTANCE_SERVER_REGISTRATION_ADDR
	NstanceServerAgentAddr        string // NSTANCE_SERVER_AGENT_ADDR

	NetsyBucket          string `validate:"omitempty"`     // NETSY_BUCKET
	NetsyEndpoint        string `validate:"omitempty,url"` // NETSY_ENDPOINT
	NetsyRegion          string // NETSY_REGION
	NetsyAccessKeyID     string // NETSY_ACCESS_KEY_ID
	NetsySecretAccessKey string // NETSY_SECRET_ACCESS_KEY

	TelemetryBucket          string `validate:"omitempty"`     // TELEMETRY_BUCKET
	TelemetryEndpoint        string `validate:"omitempty,url"` // TELEMETRY_ENDPOINT
	TelemetryRegion          string // TELEMETRY_REGION
	TelemetryLogServices     string `validate:"omitempty,service_list"` // TELEMETRY_LOG_SERVICES
	TelemetryLogCloudinit    string `validate:"required,boolstr"`       // TELEMETRY_LOG_CLOUDINIT
	TelemetryAccessKeyID     string // TELEMETRY_ACCESS_KEY_ID
	TelemetrySecretAccessKey string // TELEMETRY_SECRET_ACCESS_KEY

	RegistryEnabled         string `validate:"required,boolstr"`           // REGISTRY_ENABLED
	RegistryHostname        string `validate:"omitempty,hostname_rfc1123"` // REGISTRY_HOSTNAME
	RegistryBucket          string `validate:"omitempty"`                  // REGISTRY_BUCKET
	RegistryEndpoint        string `validate:"omitempty,url"`              // REGISTRY_ENDPOINT
	RegistryRegion          string // REGISTRY_REGION
	RegistryAccessKeyID     string // REGISTRY_ACCESS_KEY_ID
	RegistrySecretAccessKey string // REGISTRY_SECRET_ACCESS_KEY
	AWSS3UsePathStyle       string `validate:"omitempty,boolstr"` // AWS_S3_USE_PATH_STYLE
}

type TemplateVars struct {
	// Manifest is the resolved vmconfig manifest for this VM.
	Manifest *deps.Manifest `validate:"required"`

	// DepsMirrorURL, when set, overrides all upstream dependency URLs with
	// mirror-relative paths (<base>/<name>/<version>/<filename>). Used for
	// local development and air-gapped installs.
	DepsMirrorURL string `validate:"omitempty,url"`

	// Env is rendered one-to-one into /opt/podplane/etc/user-data.env.
	Env EnvVars

	// NstanceRegistrationNonceJWT is written directly to nonce.jwt. It is not
	// rendered into user-data.env because it is a sensitive one-time credential.
	NstanceRegistrationNonceJWT string
}