let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  buildkit_lite | default = {
    namespace  | default = "build-system",
    deployment | default = "buildkit",
    port       | default = 1234,
    image      | default = "moby/buildkit:v0.13.2",
    replicas   | default = 1,

    resources | default = {
      requests = { cpu = "500m",  memory = "512Mi" },
      limits   = { cpu = "4",     memory = "4Gi"   },
    },

    privileged       | default = true,
    registry_secret  | default = "zot-credentials",

    live_check | default = {
      strategy  = 'k8s_pods,
      namespace = "build-system",
      selector  = "buildkit",
    },

    requires | default = {
      capabilities = ["k8s-cluster-access", "buildkit-daemon"],
    },

    provides | default = {
      service   = "buildkit_lite",
      interface = "buildkit-tcp",
    },

    grpc | default = {
      keepalive_time    | default = "30s",
      keepalive_timeout | default = "10s",
    },

    vpn_service | default = {
      enabled       = false,
      nodeport      = 31234,
      external_ips  = [],
      service_name  = "vpn",
    },

    mtls | default = {
      enabled                 = false,
      ca_secret               = "buildkit-mtls-ca",
      server_cert_secret      = "buildkit-mtls-server",
      cert_mount_path         = "/etc/buildkit/certs",
      cert_manager = {
        enabled             = false,
        cluster_issuer_name = "buildkit-selfsigned-issuer",
        ca_issuer_name      = "buildkit-ca-issuer",
        ca_common_name      = "buildkit-mtls-ca",
        ca_duration         = "43800h",
        ca_renew_before     = "720h",
        server_common_name  = "buildkitd",
        server_dns_names    = ["buildkitd"],
        server_ip_sans      = [],
        server_duration     = "2160h",
        server_renew_before = "360h",
      },
    },

    operations | default = {
      install = true,
      health  = true,
    },

    # Cache backing for /var/lib/buildkit. Off by default (anonymous image VOLUME);
    # opt in per instance to use a bounded PVC + buildkitd GC ceiling.
    cache | default = {
      enabled         = false,
      size            = "10Gi",
      # local-path by default: the buildkit cache is disposable, so node-local disk is
      # the right backing — not a paid cloud volume. gckeepstorage is the real size bound.
      storage_class   = "local-path",
      mount_path      = "/var/lib/buildkit",
      gc_keep_storage = "8GB",
    },

    # ServiceConcerns — lite builder; no persistent state, registry traffic in-cluster.
    # tls.kind flips to 'enforced when vpn_service.enabled AND mtls.enabled in the instance overlay.
    concerns | default = _presets.infrastructure_glue & {
      tls    | force = { kind = 'disabled, reason = "TCP inside cluster; mTLS not required for in-cluster port-forward path" },
      backup | force = { kind = 'disabled, reason = "no persistent state; BuildKit cache is ephemeral layer storage on the pod" },
    },
  },
}