let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  docker_mailserver | default = {
    name           | default = "docker-mailserver",
    version        | default = "15.1.0",
    image          | default = "ghcr.io/docker-mailserver/docker-mailserver:15.1.0",
    gui_version    | default = "v1.5.7",
    gui_image      | default = "audioscavenger/dms-gui:v1.5.7",
    namespace      | default = "mail",
    hostname       | default = "mail.example.com",
    domain         | default = "example.com",
    node           | default = "",
    lb_ipam_ip     | default = "",
    private_lb_ip  | default = "",
    private_cidr   | default = "",
    tls_secret     | default = "docker-mailserver-tls",
    cluster_issuer | default = "letsencrypt-prod",
    storage_class  | default = "hcloud-volumes",
    mode           | default = 'cluster,

    smtp_port       | default = 25,
    imap_port       | default = 143,
    smtps_port      | default = 465,
    submission_port | default = 587,
    imaps_port      | default = 993,
    pop3s_port      | default = 995,
    gui_port        | default = 80,

    enable_rspamd       | default = "1",
    enable_clamav       | default = "0",
    enable_fail2ban     | default = "0",
    enable_spamassassin | default = "0",
    enable_postgrey     | default = "0",
    enable_pop3         | default = "0",
    postgrey_delay      | default = "300",

    postmaster_address | default = "",
    fail2ban_blocktype  | default = "drop",
    fail2ban_ignoreip  | default = [],
    spam_to_inbox      | default = "0",
    move_spam_to_junk  | default = "1",
    sa_tag             | default = "2.0",
    sa_tag2            | default = "6.31",
    sa_kill            | default = "10.0",
    log_level          | default = "warn",

    relay = {
      host | default = "",
      port | default = 587,
      tls  | default = true,
      name | default = "ses",
    },

    requires | default = {
      storage = {
        mail_data = { size = "20Gi", persistent = true },
      },
      ports = [
        { port = 25,  exposure = 'public },
        { port = 143, exposure = 'public },
        { port = 465, exposure = 'public },
        { port = 587, exposure = 'public },
        { port = 993, exposure = 'public },
        { port = 80,  exposure = 'internal },
      ],
      credentials = ["RELAY_USER", "RELAY_PASSWORD", "MAIL_ADMIN_EMAIL", "MAIL_ADMIN_PASS"],
    },

    provides | default = {
      service   = "docker-mailserver",
      ports     = [25, 143, 465, 587, 993],
      endpoints = [],
    },

    operations | default = {
      install  = true,
      update   = true,
      delete   = true,
      backup   = true,
      restore  = true,
      health   = true,
      config   = true,
      restart  = true,
    },
    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — docker-mailserver; tls_endpoint_with_acme preset.
    # Reference: ADR-008 (umbrella), ADR-009 (progressive coverage).
    concerns | default = (_presets.tls_endpoint_with_acme {
      tls_secret         = "docker-mailserver-tls",
      cluster_issuer     = "letsencrypt-prod",
      hostnames          = [],
      dns_internal       = [],
      dns_zone           = "",
      acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
      acme_email         = "",
      cert_secret_ref    = "",
      cert_provider      = 'cloudflare,
      backup_backlog_ref = "BACKUP-MAIL-001",
    }) & {
      backup | force = {
        kind        = 'pending,
        reason      = "BackupPolicy declared at workspace level (mail-stack BackupGroup)",
        backlog_ref = "BACKUP-MAIL-001",
      },
    },
  },
}