let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  ETCD = {
    version | String,
    name | String,
    etcd_name | String,
    ssl_mode
      | String
      | doc "TLS cert tool: openssl or cfssl",
    ssl_sign
      | String
      | doc "Signing key algorithm: ECC or RSA",
    ca_sign | String,
    ssl_curve
      | String
      | doc "ECC curve name, empty for RSA (prime256v1, secp384r1, secp521r1)",
    long_sign
      | Number
      | doc "RSA key length in bits (2048 or 4096)",
    cipher | String,
    ca_sign_days | Number,
    sign_days | Number,
    sign_sha
      | Number
      | doc "SHA digest bits for signatures (256, 384, 512)",
    sign_pass | String,
    etcd_protocol
      | String
      | doc "etcd listen protocol: https or http",
    source_url
      | String
      | doc "Binary download source: github or google",
    cluster_name | String,
    hostname | String,
    cn | String,
    c
      | String
      | doc "Certificate country code (2-letter ISO)",
    data_dir | String,
    conf_path | String,
    log_level | String,
    log_out | String,
    discover_url | String,
    cli_ip | String,
    cli_port | Number,
    peer_ip | String,
    peer_port | Number,
    cluster_list
      | String
      | doc "Comma-separated name=URL pairs for initial cluster (e.g. 'cp=https://10.0.0.1:2380')",
    token | String,
    certs_path | String,
    prov_path | String,
    listen_peers | String,
    adv_listen_peers | String,
    initial_peers | String,
    listen_clients | String,
    adv_listen_clients | String,
    use_localhost | Bool,
    dns_domain_path | String,
    domain_name | String,
    discovery_srv | String,
    use_dns | Bool,

    # ServiceConcerns umbrella (ADR-008). etcd state is captured by
    # SystemBackupDef.etcd via etcdctl from the CP host (system cron).
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}