# Provisioning Constraints - Single Source of Truth
# Used by: Forms (validation), Nickel validators (contracts), Templates (limits)
# Version: 1.0.0

[project]
name_min_length = 1
name_max_length = 64
name_pattern = "^[a-z0-9-]+$"
version_pattern = "^[0-9]+\\.[0-9]+\\.[0-9]+$"
description_max_length = 500

[service]
# Service type must be one of these
allowed_types = ["api", "worker", "scheduler", "frontend", "backend", "database", "cache", "queue"]
name_min_length = 1
name_max_length = 32
name_pattern = "^[a-z0-9-]+$"
replicas_min = 1
replicas_max = 100
healthcheck_interval_min = 5
healthcheck_interval_max = 300
healthcheck_timeout_min = 1
healthcheck_timeout_max = 60
healthcheck_retries_min = 1
healthcheck_retries_max = 10

[service.image]
name_min_length = 1
name_max_length = 256
tag_max_length = 128
tag_pattern = "^[a-zA-Z0-9._-]+$"

[service.ports]
container_port_min = 1
container_port_max = 65535
host_port_min = 1024
host_port_max = 65535
protocol_allowed = ["tcp", "udp", "sctp"]

[service.resources]
# CPU limits in millicores or cores (e.g., "100m", "1.5")
cpu_limit_pattern = "^[0-9]+(\\.[0-9]+)?[m]?$"
cpu_request_pattern = "^[0-9]+(\\.[0-9]+)?[m]?$"
# Memory limits (e.g., "128Mi", "1Gi", "512M")
memory_limit_pattern = "^[0-9]+(Mi|Gi|M|G|Ki|K)$"
memory_request_pattern = "^[0-9]+(Mi|Gi|M|G|Ki|K)$"

[database]
allowed_types = ["sqlite", "postgres", "mysql", "surrealdb", "none"]
name_pattern = "^[a-zA-Z0-9_]+$"
name_max_length = 64

[database.sqlite]
database_path_max_length = 256

[database.postgres]
host_max_length = 256
port_min = 1024
port_max = 65535
database_name_max_length = 64
username_max_length = 64
password_min_length = 8
password_max_length = 128
pool_size_min = 1
pool_size_max = 1000
connection_timeout_min = 1
connection_timeout_max = 300
idle_timeout_min = 60
idle_timeout_max = 3600
max_lifetime_min = 300
max_lifetime_max = 86400

[database.mysql]
host_max_length = 256
port_min = 1024
port_max = 65535
database_name_max_length = 64
username_max_length = 32
password_min_length = 8
password_max_length = 128
pool_size_min = 1
pool_size_max = 1000
connection_timeout_min = 1
connection_timeout_max = 300

[database.surrealdb]
host_max_length = 256
port_min = 1024
port_max = 65535
namespace_max_length = 64
database_name_max_length = 64
username_max_length = 64
password_min_length = 8
password_max_length = 128

[deployment.docker_compose]
version_allowed = ["3.8", "3.9"]
restart_policy_allowed = ["no", "always", "on-failure", "unless-stopped"]

[deployment.kubernetes]
namespace_pattern = "^[a-z0-9-]+$"
namespace_max_length = 63
api_version_allowed = ["v1", "apps/v1", "networking.k8s.io/v1"]

[deployment.kubernetes.ingress]
path_type_allowed = ["Prefix", "Exact", "ImplementationSpecific"]
class_name_max_length = 64

[network]
network_name_pattern = "^[a-z0-9-]+$"
network_name_max_length = 64
driver_allowed = ["bridge", "host", "overlay", "macvlan", "none"]
subnet_pattern = "^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$"

[storage]
volume_name_pattern = "^[a-z0-9-]+$"
volume_name_max_length = 64
driver_allowed = ["local", "nfs", "cifs"]
mount_path_max_length = 256
size_pattern = "^[0-9]+(Mi|Gi|Ti|M|G|T)$"

[monitoring.prometheus]
port_min = 1024
port_max = 65535
scrape_interval_min = 5
scrape_interval_max = 300
evaluation_interval_min = 5
evaluation_interval_max = 300
retention_pattern = "^[0-9]+(d|h|m)$"

[monitoring.grafana]
port_min = 1024
port_max = 65535
admin_password_min_length = 8
admin_password_max_length = 128

[security.tls]
cert_path_max_length = 256
key_path_max_length = 256
ca_path_max_length = 256

[security.secrets]
secret_name_pattern = "^[a-z0-9-]+$"
secret_name_max_length = 64
secret_key_max_length = 64

[security.auth]
allowed_methods = ["none", "basic", "bearer", "oauth2", "jwt", "api_key"]
token_expiry_min = 300
token_expiry_max = 86400

[environment]
# Environment variable constraints
var_name_pattern = "^[A-Z_][A-Z0-9_]*$"
var_name_max_length = 128
var_value_max_length = 4096
