Terraform variables¶

All 136 root input variables are declared in stage2/variables.tf and passed down to modules. Child modules declare their own inputs and receive them from the root; none reads TF_VAR_* directly, which is why every value is set in one place.

Values are supplied as TF_VAR_* environment variables, injected from Bitwarden when you enter the tooling container. There is no terraform.tfvars; *.tfvars is gitignored.

Grouping¶

Variables are prefixed by the module that consumes them.

Prefix	Count	Module
`gitlab_*`	16	gitlab-platform
`litellm_*`	14	litellm
`omniroute_*`	13	omniroute-gateway
`prometheus_*`	12	monitoring
`argocd_*`	10	argocd, argocd-updater
`minio_*`	9	minio-object-storage
`auth_*`	7	auth
`elasticsearch_`, `kibana_`	10	logging
`wireguard_`, `tailscale_`	8	tailscale, wireguard
`datadog_*`	5	datadog
`cloudflare_*`	5	cloudflare-tunnel
`nginx_`, `ingress_`	5	nginx
`kubecost_*`	4	monitoring-kubecost
`cert_*`	4	cert-manager-letsencrypt
`longhorn_*`	3	longhorn-storage
`kubernetes_*`	3	kubernetes
`sealed_*`	2	bitnami-sealed-secrets

Each module page documents the variables it actually consumes, with defaults. This page is the index; the module page is the reference.

Enable flags¶

The gates that decide whether a module is in the plan at all:

Variable	Default	Module
`logging_module_enable`	`true`	logging
`argocd_image_updater_enable`	`false`	argocd-updater
`datadog_enable`	`false`	datadog
`cloudflare_tunnel_enable`	`false`	cloudflare-tunnel
`sealed_secrets_enable`	`true`	bitnami-sealed-secrets
`litellm_enable`	`false`	litellm
`omniroute_enable`	`false`	omniroute-gateway
`tailscale_enable`	`false`	vpn, Tailscale backend
`wireguard_enable`	`false`	vpn, WireGuard backend

GitLab has no flag. It is gated on host_machine_architecture == "amd64".

Cross-cutting variables¶

Variable	Used by
`host_machine_architecture`	Gates GitLab; also read by Stage 1
`container_*`	Shared image registry and pull settings
`hostname_prefix`	Tailnet machine names in the vpn module. Deliberately not prefixed by a module: Stage 0 and Stage 1 read the same value, so every device sorts together in the tailnet

Conventions¶

snake_case, prefixed by consuming module.
Every variable declares a type, a description, and a default where one is sensible.
Validation blocks are used where a bad value would fail late and confusingly.
Longer rationale goes in a comment above the block, not in the description.

Reading the file directly is often faster than any summary:

grep -A6 'variable "gitlab_' stage2/variables.tf