# Provisioning Constraints - Single Source of Truth
# Used by: Forms (validation), Nickel validators (contracts), Templates (limits)
# Version: 1.0.0

[project]
description_max_length = 500
name_max_length = 64
name_min_length = 1
name_pattern = "^[a-z0-9-]+$"
version_pattern = "^[0-9]+\\.[0-9]+\\.[0-9]+$"

[service]
# Service type must be one of these
allowed_types = ["api", "worker", "scheduler", "frontend", "backend", "database", "cache", "queue"]
healthcheck_interval_max = 300
healthcheck_interval_min = 5
healthcheck_retries_max = 10
healthcheck_retries_min = 1
healthcheck_timeout_max = 60
healthcheck_timeout_min = 1
name_max_length = 32
name_min_length = 1
name_pattern = "^[a-z0-9-]+$"
replicas_max = 100
replicas_min = 1

  [service.image]
  name_max_length = 256
  name_min_length = 1
  tag_max_length = 128
  tag_pattern = "^[a-zA-Z0-9._-]+$"

  [service.ports]
  container_port_max = 65535
  container_port_min = 1
  host_port_max = 65535
  host_port_min = 1024
  protocol_allowed = ["tcp", "udp", "sctp"]

  [service.resources]
  # CPU limits in millicores or cores (e.g., "100m", "1.5")
  cpu_limit_pattern = "^[0-9]+(\\.[0-9]+)?[m]?$"
  cpu_request_pattern = "^[0-9]+(\\.[0-9]+)?[m]?$"
  # Memory limits (e.g., "128Mi", "1Gi", "512M")
  memory_limit_pattern = "^[0-9]+(Mi|Gi|M|G|Ki|K)$"
  memory_request_pattern = "^[0-9]+(Mi|Gi|M|G|Ki|K)$"

[database]
allowed_types = ["sqlite", "postgres", "mysql", "surrealdb", "none"]
name_max_length = 64
name_pattern = "^[a-zA-Z0-9_]+$"

  [database.sqlite]
  database_path_max_length = 256

  [database.postgres]
  connection_timeout_max = 300
  connection_timeout_min = 1
  database_name_max_length = 64
  host_max_length = 256
  idle_timeout_max = 3600
  idle_timeout_min = 60
  max_lifetime_max = 86400
  max_lifetime_min = 300
  password_max_length = 128
  password_min_length = 8
  pool_size_max = 1000
  pool_size_min = 1
  port_max = 65535
  port_min = 1024
  username_max_length = 64

  [database.mysql]
  connection_timeout_max = 300
  connection_timeout_min = 1
  database_name_max_length = 64
  host_max_length = 256
  password_max_length = 128
  password_min_length = 8
  pool_size_max = 1000
  pool_size_min = 1
  port_max = 65535
  port_min = 1024
  username_max_length = 32

  [database.surrealdb]
  database_name_max_length = 64
  host_max_length = 256
  namespace_max_length = 64
  password_max_length = 128
  password_min_length = 8
  port_max = 65535
  port_min = 1024
  username_max_length = 64

[deployment.docker_compose]
restart_policy_allowed = ["no", "always", "on-failure", "unless-stopped"]
version_allowed = ["3.8", "3.9"]

[deployment.kubernetes]
api_version_allowed = ["v1", "apps/v1", "networking.k8s.io/v1"]
namespace_max_length = 63
namespace_pattern = "^[a-z0-9-]+$"

  [deployment.kubernetes.ingress]
  class_name_max_length = 64
  path_type_allowed = ["Prefix", "Exact", "ImplementationSpecific"]

[network]
driver_allowed = ["bridge", "host", "overlay", "macvlan", "none"]
network_name_max_length = 64
network_name_pattern = "^[a-z0-9-]+$"
subnet_pattern = "^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$"

[storage]
driver_allowed = ["local", "nfs", "cifs"]
mount_path_max_length = 256
size_pattern = "^[0-9]+(Mi|Gi|Ti|M|G|T)$"
volume_name_max_length = 64
volume_name_pattern = "^[a-z0-9-]+$"

[monitoring.prometheus]
evaluation_interval_max = 300
evaluation_interval_min = 5
port_max = 65535
port_min = 1024
retention_pattern = "^[0-9]+(d|h|m)$"
scrape_interval_max = 300
scrape_interval_min = 5

[monitoring.grafana]
admin_password_max_length = 128
admin_password_min_length = 8
port_max = 65535
port_min = 1024

[security.tls]
ca_path_max_length = 256
cert_path_max_length = 256
key_path_max_length = 256

[security.secrets]
secret_key_max_length = 64
secret_name_max_length = 64
secret_name_pattern = "^[a-z0-9-]+$"

[security.auth]
allowed_methods = ["none", "basic", "bearer", "oauth2", "jwt", "api_key"]
token_expiry_max = 86400
token_expiry_min = 300

[environment]
# Environment variable constraints
var_name_max_length = 128
var_name_pattern = "^[A-Z_][A-Z0-9_]*$"
var_value_max_length = 4096