let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  acme_certd | default = {
    name    | default = "acme_certd",
    version | default = "0.1.0",
    mode    | default = 'systemd_timer,

    acme_sh_version | default = "3.0.9",
    server          | default = 'letsencrypt,
    dns_provider    | default = "dns_cf",
    dns_token_ref   | default = "UNSET",
    domains         | default = [],
    acme_email      | default = "UNSET",
    cert_dir        | default = "/etc/ssl/acme",
    renewal_check   | default = "12h",
    user            | default = "acme",
    group           | default = "acme",
    reload_hooks    | default = [],

    requires | default = {
      credentials  = [],
      capabilities = ["vm-lifecycle", "ssh-access", "dns-api-token"],
    },

    provides | default = {
      service   = "acme_certd",
      interface = "acme-certd",
    },

    operations | default = {
      install = true,
      update  = true,
      health  = true,
    },

    concerns | default = _presets.infrastructure_glue & {
      tls    | force = { kind = 'enabled, reason = "this component IS the TLS issuer" },
      backup | force = { kind = 'pending, reason = "cert dir should be backed up; acme.sh account key loss requires re-registration" },
    },
  },
}