output "hosts" {
  description = "Hostname, public IPv4, VPC IPv4 and (vpn hosts) wg address, loopback and public key per host."
  value = merge(
    { for k, v in binarylane_server.edge : k => {
      hostname    = v.name
      public_ipv4 = v.public_ipv4_addresses[0]
      vpc_ipv4    = local.edges[k].vpc_ip
    } },
    { for k, v in binarylane_server.vpn : k => {
      hostname    = v.name
      public_ipv4 = v.public_ipv4_addresses[0]
      vpc_ipv4    = local.vpns[k].vpc_ip
      wg_address  = local.vpns[k].wg_address
      loopback    = local.vpns[k].loopback
      wg_pubkey   = wireguard_asymmetric_key.vpn[k].public_key
    } },
  )
}

output "router_links" {
  description = "Per-region p2p wg/ospf link as prodnxsr0020 sees it; vpc_cidr arrives via ospf. Consumed by its Puppet config."
  value = { for k, v in local.enabled_vpns : v.region => {
    interface              = "wg-${v.region}"
    listen_port            = v.router_port
    router_address         = "${v.router_address}/31"
    peer_address           = "${v.wg_address}/31"
    peer_loopback          = "${v.loopback}/32"
    allowed_ips            = ["${v.wg_address}/32", "${v.loopback}/32", local.vpcs[v.region], local.ospf_allspf]
    peer_public_key        = wireguard_asymmetric_key.vpn[k].public_key
    peer_endpoint          = "${binarylane_server.vpn[k].public_ipv4_addresses[0]}:${local.wg_port}"
    vpc_cidr               = local.vpcs[v.region]
    private_key_vault_path = "kv/${vault_kv_secret_v2.router[k].name}"
    peer_key_vault_path    = "kv/${vault_kv_secret_v2.vpn[k].name}"
  } }
}