let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  etcd | default = {
    version          | default = "3.6.10",
    name             | default = "etcd",
    cmd_task         | default = "install",
    etcd_name        | default = "{{hostname}}",
    ssl_mode         | default = "openssl",
    ssl_sign         | default = "RSA",
    ca_sign          | default = "RSA",
    ssl_curve        | default = "prime256v1",
    long_sign        | default = 4096,
    cipher           | default = "",
    ca_sign_days     | default = 1460,
    sign_days        | default = 730,
    sign_sha         | default = 256,
    sign_pass        | default = "",
    etcd_protocol    | default = "https",
    source_url       | default = "github",
    cluster_name     | default = "etcd-cluster",
    hostname         | default = "etcd-node",
    cn               | default = "etcd",
    c                | default = "US",
    data_dir         | default = "/var/lib/etcd",
    conf_path        | default = "/etc/etcd/config.yaml",
    log_level        | default = "warn",
    log_out          | default = "stderr",
    discover_url     | default = "",
    cli_ip           | default = "127.0.0.1",
    cli_port         | default = 2379,
    peer_ip          | default = "127.0.0.1",
    peer_port        | default = 2380,
    cluster_list     | default = "",
    token            | default = "etcd-cluster",
    certs_path       | default = "/etc/ssl/etcd",
    prov_path        | default = "etcdcerts",
    listen_peers     | default = "",
    adv_listen_peers | default = "",
    initial_peers    | default = "",
    listen_clients   | default = "",
    adv_listen_clients | default = "",
    use_localhost    | default = false,
    dns_domain_path  | default = "",
    domain_name      | default = "",
    discovery_srv    | default = "",
    use_dns          | default = true,
    operations | default = {
      install   = true,
      reinstall = true,
      delete    = true,
      health    = true,
    },

    # ServiceConcerns default — etcd; infrastructure_glue with custom tls/certs/backup reasons.
    concerns | default = _presets.infrastructure_glue & {
      tls    | force = { kind = 'disabled, reason = "etcd manages its own peer/client TLS via mtls; PKI captured by SystemBackupDef.k8s_certs" },
      certs  | force = { kind = 'disabled, reason = "ACME issuance handled by cert-manager component, not etcd" },
      backup | force = { kind = 'disabled, reason = "etcd state captured by SystemBackupDef.etcd via etcdctl from CP host (system cron, every 6h)" },
    },
  },
}