digraph Resources {
  rankdir=LR;
  node [shape=rectangle, style=filled, fillcolor="#EFEFEF", fontname="Helvetica"];

  // Nodes: resource (type/name) with key params
  Provider [label="provider: nubes\n(api_endpoint, api_token)", fillcolor="#E8F4FF"];
  Organization [label="nubes_organization\n(id, display_name)"];
  VDC [label="nubes_vdc\n(id, display_name, organization_uid, provider_vdc, network_pool)"];
  Edge [label="nubes_edge\n(id, display_name, vdc_uid, external_network)"];
  VApp [label="nubes_vapp\n(id, display_name, vdc_uid, edge_uid, vapp_name)"];
  VM [label="nubes_vm_instance\n(id, display_name, vapp_uid, vm_name, user_public_key, ip_space_name, access_port_list, access_ip_list)"];
  TLSKey [label="tls_private_key\n(private_key_pem, public_key_openssh)", fillcolor="#FFF4E8"];
  LocalFile [label="local_sensitive_file\n(filename, content = tls_private_key.private_key_pem)"];
  RemoteState [label="data.terraform_remote_state.vapp\n(outputs.vapp_id)", fillcolor="#F0FFF0"];
  Consumer [label="consumer module\n(e.g. client_package_windows)\nuses access_ip_list"];

  // Dependency edges (resource -> resource it depends on) with parameter labels
  VDC -> Organization [label="organization_uid", fontsize=10];
  Edge -> VDC [label="vdc_uid", fontsize=10];
  VApp -> VDC [label="vdc_uid", fontsize=10];
  VApp -> Edge [label="edge_uid", fontsize=10];
  VM -> VApp [label="vapp_uid", fontsize=10];
  VM -> TLSKey [label="user_public_key <- public_key_openssh", fontsize=10];
  LocalFile -> TLSKey [label="content <- private_key_pem", fontsize=10];
  Consumer -> VM [label="access_ip_list (jsondecode(...)[0])", fontsize=10];
  VM -> RemoteState [label="vapp_uid = vapp.outputs.vapp_id (remote)", fontsize=10, style=dashed];

  // Provider relations (dotted to many)
  Provider -> VDC [style=dotted];
  Provider -> Edge [style=dotted];
  Provider -> VApp [style=dotted];
  Provider -> VM [style=dotted];
  Provider -> Organization [style=dotted];

  // Visual tweaks
  edge [fontname="Helvetica", fontsize=10];
}