let _context_lib = import "schemas/catalog/context.ncl" in

{
  BuildkitLite = {
    namespace  | String,
    deployment | String,
    port       | std.number.Nat,
    image      | String,
    replicas   | std.number.Nat,
    resources  | {
      requests | { cpu | String, memory | String },
      limits   | { cpu | String, memory | String },
    },
    privileged | Bool,

    requires | {
      capabilities | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      interface | String | optional,
    } | default = {},

    grpc | {
      keepalive_time    | String | doc "Server→client gRPC ping interval. Keeps NAT entries alive during long builds." | default = "30s",
      keepalive_timeout | String | doc "Time buildkitd waits for a ping ack before closing the connection." | default = "10s",
    } | default = {},

    vpn_service | {
      enabled       | Bool | doc "Expose buildkitd through a NodePort reachable on the daoshi node IP (wuwei VPN)." | default = false,
      nodeport      | std.number.Nat | doc "Fixed NodePort in 30000-32767. Used only when enabled." | default = 31234,
      external_ips  | Array String | doc "Optional externalIPs to bind the Service on (use only with single-node clusters)." | default = [],
      service_name  | String | doc "Name suffix for the VPN-facing Service. Final name: <deployment>-vpn." | default = "vpn",
    } | default = {},

    mtls | {
      enabled                 | Bool | doc "Enable mTLS on buildkitd. Required when vpn_service is enabled in any non-trusted network." | default = false,
      ca_secret               | String | doc "K8s Secret (same namespace) with key ca.crt — clients must present a cert signed by this CA." | default = "buildkit-mtls-ca",
      server_cert_secret      | String | doc "K8s Secret (same namespace) with keys tls.crt and tls.key — buildkitd server cert/key." | default = "buildkit-mtls-server",
      cert_mount_path         | String | doc "Mount path inside the buildkitd container for cert material." | default = "/etc/buildkit/certs",

      cert_manager | {
        enabled               | Bool | doc "Provision CA and server cert via cert-manager (SelfSigned ClusterIssuer → CA Certificate → namespaced CA Issuer → server Certificate)." | default = false,
        cluster_issuer_name   | String | doc "Name of the SelfSigned ClusterIssuer (shared, idempotent)." | default = "buildkit-selfsigned-issuer",
        ca_issuer_name        | String | doc "Name of the namespace-scoped CA Issuer that signs leaf certs." | default = "buildkit-ca-issuer",
        ca_common_name        | String | doc "Subject CN on the CA cert." | default = "buildkit-mtls-ca",
        ca_duration           | String | doc "CA validity (ISO 8601 duration). 5 years default." | default = "43800h",
        ca_renew_before       | String | doc "CA renewal lead time." | default = "720h",
        server_common_name    | String | doc "Subject CN on the server leaf cert." | default = "buildkitd",
        server_dns_names      | Array String | doc "DNS SANs on the server cert (at least one VPN hostname recommended)." | default = ["buildkitd"],
        server_ip_sans        | Array String | doc "IP SANs on the server cert (node IP for direct VPN access)." | default = [],
        server_duration       | String | doc "Server cert validity." | default = "2160h",
        server_renew_before   | String | doc "Server cert renewal lead time." | default = "360h",
      } | default = {},
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = false,
      delete  | Bool | default = false,
      health  | Bool | default = false,
    } | default = {},

    cache | {
      enabled         | Bool | doc "Back the buildkitd cache dir with a PersistentVolumeClaim instead of the image's ephemeral anonymous VOLUME. The anonymous VOLUME grows unbounded on the node root filesystem and on a control-plane node can fill / and trigger DiskPressure eviction. Requires a working CSI on the target node." | default = false,
      size            | String | doc "Cache PVC size." | default = "10Gi",
      storage_class   | String | doc "StorageClass for the cache PVC. Default local-path (node-local disk) — the buildkit cache is disposable, so a paid cloud volume is unnecessary; gckeepstorage bounds the actual size." | default = "local-path",
      mount_path      | String | doc "buildkitd cache directory (the image's declared VOLUME)." | default = "/var/lib/buildkit",
      gc_keep_storage | String | doc "buildkitd worker GC ceiling — keeps the on-disk cache under this size. Set below the PVC size to leave headroom for the active build." | default = "8GB",
    } | default = {},

    context | _context_lib.ComponentContext | optional,

    ..
  },
}