cloudflare_api_token    = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" # Placeholder (format-valid)
cloudflare_account_id   = "00000000000000000000000000000000"         # Placeholder (format-valid)
cloudflare_account_name = ""

trusted_admin_ips = []
blocked_countries = []

enable_managed_waf    = true
enable_bot_management = false

# Intentionally violates the "pro plan must create exactly 1 managed_waf + 1 bot_management" invariant.
# Used by scripts/waf-and-plan-invariants.sh negative-control check.
domains = {
  "offsec.global" = {
    plan       = "free"
    jump_start = false
  }
  "offsecglobal.com" = {
    plan       = "free"
    jump_start = false
  }
  "offsecagent.com" = {
    plan       = "free"
    jump_start = false
  }
  "offsecshield.com" = {
    plan       = "free"
    jump_start = false
  }
  "vaultmesh.org" = {
    plan       = "pro"
    jump_start = false
  }
}