locals {
  dev = {
    env_suffix = "next"
    project    = "exemplary-proxy-507408-d6"

    lb = true
    hostnames = {
      svfe   = "next.tangled.org"
      bobbin = "api.next.tangled.org"
    }

    region        = "europe-north1"
    network_name  = "tangled"
    registry_name = "tangled"

    registry_retention   = { keep = 8, days = 3 }
    registry_description = "dev images for the next.* services"

    # spindle runs that are authorized for deploys of this env
    ci_oidc = {
      issuer     = "https://tokens.spindle.tangled.sh"
      repository = "did:plc:j5hmlfdrwkvtxm7cjmu7j2is"
      ref        = "refs/heads/sv-fe"
    }

    # a hub is shared infra that should be used for a cell instance
    # hub: hydrant, km, ... (see kinds.tf), on nodes it runs or ones elsewhere with a `url`
    # cell: bobbin, web client...
    hubs = {
      eu = {
        nodes = {
          hydrant    = { name = "hyd-gcp-eu-1", cell = "eu", zone = "europe-north1-a", internal_ip = "10.166.15.10", tunnel = true }
          knotmirror = { url = "https://mirror-fsn.tangled.network" }
        }

        cells = {
          eu = {
            cidr             = "10.166.0.0/20"
            ipv6_access_type = "EXTERNAL"
            region           = "europe-north1"
            subnet           = "tangled-eu-north"
          }
        }
      }

      kr = {
        nodes = {
          hydrant    = { name = "hyd-gcp-kr-1", cell = "kr", zone = "asia-northeast3-a", internal_ip = "10.178.15.10" }
          knotmirror = { url = "https://mirror-fsn.tangled.network" }
        }

        cells = {
          kr = {
            cidr             = "10.178.0.0/20"
            ipv6_access_type = "EXTERNAL"
            region           = "asia-northeast3"
            subnet           = "tangled-asia-northeast3"
          }
        }
      }
    }

    # not in a hub because no bobbin reads them, so a `cell` only places them
    nodes = {
      # hostname is its did:web, so changing it orphans every grant it holds
      migrator = {
        name        = "migrator-eu-1"
        cell        = "eu"
        zone        = "europe-north1-a"
        internal_ip = "10.166.0.3"
        hostname    = "migrator-dev.tangled.network"
      }
      knot = {
        name        = "knot-eu-1"
        cell        = "eu"
        zone        = "europe-north1-a"
        internal_ip = "10.166.15.12"
        hostname    = "knot.next.tangled.network"
      }
    }

    # workers/<env> deploys these from the bundles deploy builds, keyed by their dir in core
    cloudflare = {
      account_id = "475a0795ff814187be629061103e5ba7"
      # a token that can edit workers scripts on the account
      token_secret = "cloudflare-workers-token"
    }

    workers = {
      seo-reporter = {
        name               = "seo-reporter-dev"
        compatibility_date = "2026-03-07"
        crons              = ["0 12 * * 1"]

        vars = {
          BASE_URL = "https://next.tangled.org"
        }

        secrets = {
          DISCORD_WEBHOOK_URL = "seo-reporter-discord-webhook"
        }

        # control gives the worker its own service account and puts its key in this binding.
        # search console doesn't do iam, so the account still needs adding as a user on the property
        google_identity = {
          key_binding = "GSC_SERVICE_ACCOUNT"
          apis        = ["searchconsole.googleapis.com"]
        }
      }

      avatar = {
        name               = "avatar-svfe-dev"
        compatibility_date = "2025-05-03"
        domains            = ["avatar-dev.tangled.org"]

        secrets = {
          AVATAR_SHARED_SECRET = "avatar-shared-secret"
        }
      }

      camo = {
        name               = "camo-svfe-dev"
        compatibility_date = "2025-04-30"
        domains            = ["camo-dev.tangled.org"]

        secrets = {
          CAMO_SHARED_SECRET = "camo-shared-secret"
        }
      }

      ogre = {
        name               = "ogre-dev"
        compatibility_date = "2026-03-07"
        domains            = ["ogre-dev.tangled.network"]
        limits             = { cpu_ms = 300000 }

        vars = {
          ENVIRONMENT = "development"
        }
      }

      sitemap = {
        name               = "sitemap-dev"
        compatibility_date = "2026-03-07"
        # svfe's SITEMAP_URL
        workers_dev = true

        vars = {
          BASE_URL       = "https://next.tangled.org"
          HYDRANT_URL    = "https://index.tangled.network"
          SHARD_MAX_URLS = "50000"
        }

        bindings = [
          { type = "d1", name = "SITEMAP_DB", id = "c0a5ac1d-b472-4bb6-acd8-d8c2a64554fa" },
          { type = "r2_bucket", name = "SITEMAP_BUCKET", bucket_name = "tangled-sitemaps-dev" },
          # hydrant's /repos over the tunnel on hyd-gcp-eu-1
          { type = "vpc_service", name = "HYDRANT", service_id = "01a11677-64af-78f2-8512-94b028e01487" },
        ]

        workflows = {
          SYNC = { name = "sitemap-dev-sync", class_name = "SyncWorkflow", schedules = ["0 0 * * *"] }
        }
      }
    }

    services = {
      bobbin = {
        image  = ":dev"
        public = true

        env = {
          BOBBIN_POCKET_URL           = "https://pocket.tangled.network"
          BOBBIN_CORS_ORIGINS         = "*"
          BOBBIN_SERVICE_DID          = "did:web:api.next.tangled.org"
          BOBBIN_OTLP_ENDPOINT        = "https://telemetry.tangled.network"
          BOBBIN_CODESEARCH_ZOEKT_URL = "https://zoekt.tangled.network"
        }

        # `user:password` from telemetry.htpasswd on prometheus-hel and from
        # zoekt.htpasswd on mirror-fsn
        secrets = {
          BOBBIN_OTLP_AUTH             = "bobbin-otlp-auth"
          BOBBIN_CODESEARCH_ZOEKT_AUTH = "bobbin-zoekt-auth"
        }
      }

      svfe = {
        image  = ":dev"
        public = true

        env = {
          AVATAR_URL               = "https://avatar-dev.tangled.org"
          BOBBIN_URL               = "https://api.next.tangled.org"
          CAMO_URL                 = "https://camo-dev.tangled.org"
          DELEGATION_DID           = "did:web:org.tngl.sh"
          DELEGATION_HANDLE_DOMAIN = "tngl.sh"
          DELEGATION_URL           = "https://delegates.tngl.sh"
          DELIBERI_URL             = "https://notifs-dev.tangled.network"
          EMAIL_DID_URL            = "https://email-did.anirudh-s-account.workers.dev"
          GITHUB_APP_SLUG          = "tangled-connector-test"
          GITHUB_CLIENT_ID         = "Iv23ct6YaHWtsHtbWOIJ"
          GOOGLE_SITE_VERIFICATION = "Ac20fTnze5NS0H3mK_SuyJ2hCh5IYYTLFHZgNgxR4EI"
          MIGRATOR_URL             = "https://migrator-dev.tangled.network"
          MODERATION_SERVICE_DID   = "did:plc:3t4yxvxwjrl55odxe2rwwhfr"
          OGRE_URL                 = "https://ogre-dev.tangled.network"
          ORIGIN                   = "https://next.tangled.org"
          SITEMAP_URL              = "https://sitemap-dev.anirudh-s-account.workers.dev"
          TANGLED_API_URL          = "https://tangled.org"
        }

        secrets = {
          AVATAR_SHARED_SECRET  = "avatar-shared-secret"
          CAMO_SHARED_SECRET    = "camo-shared-secret"
          EMAIL_DID_TOKEN       = "email-did-token"
          GITHUB_CLIENT_SECRET  = "github-client-secret"
          GITHUB_SESSION_SECRET = "github-session-secret"
        }
      }
    }
  }
}