let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  AcmeIssuer = {
    name        | String,
    acme_server | String,
    email       | String,
    solver      | [| 'dns01, 'http01 |],
    zone        | String,
    dns_provider | [| 'cloudflare, 'hetzner, 'aws |] | optional,
    secret_ref   | String | optional,
  },

  SelfSignedIssuer = {
    name | String,
  },

  CaIssuer = {
    name       | String,
    secret_ref | String,
  },

  IssuerSpec = [| 'acme AcmeIssuer, 'ca CaIssuer, 'selfsigned SelfSignedIssuer |],

  CertificateSpec = {
    name          | String,
    namespace     | String,
    dns_names     | Array String,
    issuer_ref    | String,
    secret_name   | String,
    is_ca         | Bool   | default = false,
    duration      | String | default = "2160h",
    renew_before  | String | default = "720h",
    key_algorithm | [| 'ECDSA, 'RSA |] | default = 'ECDSA,
    key_size      | Number | default = 256,
  },

  TlsBackup = {
    enabled         | Bool   | default = false,
    kubectl_version | String | default = "v1.32.3",
    nushell_image   | String | default = "ghcr.io/nushell/nushell:latest",
  },

  CertManager = {
    version   | String,
    namespace | String | default = "cert-manager",
    cluster_issuers | Array {
      kind        | [| 'acme, 'ca, 'selfsigned |],
      name        | String,
      acme_server | String | optional,
      email       | String | optional,
      solver      | [| 'dns01, 'http01 |] | optional,
      zone        | String | optional,
      dns_provider | [| 'cloudflare, 'hetzner, 'aws |] | optional,
      secret_ref  | String | optional,
      # One entry per DNS-01 solver. dns_zones scopes a solver to specific
      # zones (cert-manager's selector.dnsZones) — omit for the catch-all
      # solver. Needed when a single issuer must resolve SANs that span
      # more than one Cloudflare zone (e.g. a cert with names in both
      # jesusperez.pro and librecloud.online).
      solvers | Array {
        secret_ref | String,
        dns_zones  | Array String | optional,
      } | optional,
    } | default = [],
    mode       | [| 'cluster |] | default = 'cluster,
    tls_backup | TlsBackup | optional,

    # DNS-01 challenge resolution: bypass the cluster CoreDNS (which can have
    # split-horizon overrides without fallthrough that return SERVFAIL for
    # _acme-challenge.* subdomains) and resolve directly via public recursive
    # nameservers when verifying TXT record propagation.
    dns01_recursive_nameservers | Array String | default = ["1.1.1.1:53", "8.8.8.8:53"],
    dns01_recursive_only        | Bool          | default = true,

    # Installs cert-manager-csi-driver DaemonSet alongside the controller.
    # Required by components using tls_rotation = 'csi_driver (e.g. private_ingress).
    # When false the csi-driver.yaml template renders empty and is skipped by the
    # installer. When true, the DaemonSet is installed in the cert-manager namespace.
    csi_driver_enabled | Bool | default = false,
    csi_driver_version | String | default = "v0.10.1",

    # ServiceConcerns umbrella (ADR-008). cert-manager itself does not own
    # data — it generates Secrets that are consumed by other components.
    # Captured by SystemBackupDef.tls_certmanager.
    concerns | _concerns_lib.ServiceConcerns | optional,
  },
}