ssh_variables.tf

variable "ssh_generate_signing_key" {
  type        = bool
  default     = true
  description = "Generate a signing key for ssh secret backend"
}

variable "ssh_private_key" {
  default     = null
  description = "The private key part the SSH CA key pair; required if ssh_generate_signing_key is false"
}

variable "ssh_public_key" {
  default     = null
  description = "The public key part the SSH CA key pair; required if ssh_generate_signing_key is false"
}

variable "ssh_backend_role_name" {
  type        = string
  default     = null
  description = "Name for SSH secret backend role"
}

variable "ssh_key_type" {
  type        = string
  default     = null
  description = "Specifies the type of credentials generated by this role. This can be either otp, dynamic or ca."
}

variable "ssh_default_ttl" {
  type        = number
  default     = 3600
  description = "Default TTL for ssh secrets backend"
}

variable "ssh_max_ttl" {
  type        = number
  default     = 3600
  description = "Maximum TTL for ssh secrets backend"
}

variable "ssh_allow_bare_domains" {
  type        = bool
  default     = true
  description = "Specifies if host certificates that are requested are allowed to use the base domains listed in ssh_allowed_domains."
}

variable "ssh_allow_host_certificates" {
  type        = bool
  default     = true
  description = "Specifies if certificates are allowed to be signed for use as a 'host'."
}

variable "ssh_allow_subdomains" {
  type        = bool
  default     = true
  description = "Specifies if host certificates that are requested are allowed to be subdomains of those listed in allowed_domains."
}

variable "ssh_allow_user_certificates" {
  type        = bool
  default     = true
  description = "Specifies if certificates are allowed to be signed for use as a 'user'."
}

variable "ssh_allow_user_key_ids" {
  type        = bool
  default     = true
  description = "Specifies if users can override the key ID for a signed certificate with the key_id field."
}

variable "ssh_allowed_critical_options" {
  type        = string
  default     = null
  description = "Specifies a comma-separated list of critical options that certificates can have when signed."
}

variable "ssh_allowed_domains" {
  type        = string
  default     = null
  description = "The list of domains for which a client can request a host certificate."
}

variable "ssh_allowed_extensions" {
  type        = string
  default     = null
  description = "Specifies a comma-separated list of extensions that certificates can have when signed."
}

variable "ssh_allowed_users" {
  type        = string
  default     = null
  description = "Specifies a comma-separated list of usernames that are to be allowed, only if certain usernames are to be allowed."
}

variable "ssh_allowed_user_key_lengths" {
  type        = map(string)
  default     = null
  description = "Specifies a map of ssh key types and their expected sizes which are allowed to be signed by the CA type."
}

variable "ssh_default_extensions" {
  type        = map(string)
  default     = null
  description = "Specifies a map of extensions that certificates have when signed."
}

variable "ssh_default_critical_options" {
  type        = map(string)
  default     = null
  description = "Specifies a map of critical options that certificates have when signed."
}

variable "ssh_cidr_list" {
  type        = string
  default     = null
  description = "The comma-separated string of CIDR blocks for which this role is applicable."
}

variable "ssh_default_user" {
  type        = string
  default     = null
  description = "Specifies the default username for which a credential will be generated."
}

variable "ssh_key_id_format" {
  type        = string
  default     = null
  description = "Specifies a custom format for the key id of a signed certificate."
}