let version  = import "./version.ncl" in
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  external_dns | default = {
    version      | default = version.EXTERNAL_DNS_VERSION,
    namespace    | default = "external-dns",
    policy       | default = 'upsert_only,
    sources      | default = ['service, 'crd],
    interval     | default = "1m",
    mode         | default = 'cluster,

    # ServiceConcerns default — external-dns reconciliation controller;
    # dns_provider preset with custom tls/certs/backup reasons.
    concerns | default = _presets.dns_provider & {
      tls    | force = { kind = 'disabled, reason = "controller-level RBAC, not TLS endpoint" },
      certs  | force = { kind = 'disabled, reason = "no ACME issuer required (cert-manager handles ACME)" },
      backup | force = { kind = 'disabled, reason = "DNS records live in upstream provider (Cloudflare, Hetzner DNS); reconciler is stateless" },
    },
  },
}