let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  FleetDaemon = {
    context | _context_lib.ComponentContext | optional,

    name      | String,
    version   | String,
    image_ref | String,
    mode      | [| 'taskserv, 'cluster, 'container |] | default = 'cluster,

    deployment | {
      kind           | [| 'kube_workload, 'taskserv |] | default = 'kube_workload,
      target_cluster | { workspace | String, cluster_name | String },
      namespace      | String | default = "fleet-system",
      replicas       | Number | default = 1,
      service        | {
        port             | Number | default = 19012,
        tls_secret_ref   | String | default = "fleet-daemon-tls",
        # 0 = ClusterIP only; non-zero = NodePort with this port number.
        # The install script derives the Service type from this field.
        channel_nodeport | Number | default = 0,
      } | default = {},
      resources | {
        requests | { cpu | String, memory | String },
        limits   | { cpu | String, memory | String },
      } | default = {
        requests = { cpu = "100m", memory = "128Mi" },
        limits   = { cpu = "500m", memory = "512Mi" },
      },
    },

    nats | {
      url            | String,
      subject_prefix | String,
      nkey_creds_ref | String,
    },

    fleets | Array String | default = [],

    node | {
      id      | String,
      ip      | String,
      pool_id | String | default = "default",
      arch    | String | default = "amd64",
      tier    | String | default = "standard",
      cpu     | Number,
      ram_gb  | Number,
      disk_gb | Number,
      buildkit_port         | Number | default = 1234,
      buildkit_probe_enabled | Bool   | default = true,
    },

    access_policy | {
      claims_accepted_from               | Array String,
      max_concurrent_claims_per_workspace | Array { workspace | String, quota | Number } | default = [],
      priority_order                     | Array String | default = [],
    },

    tick_interval_seconds | Number | default = 30,

    snapshot | {
      interval_seconds | Number | default = 300,
      retain_seconds   | Number | default = 86400,
      local_path       | String | default = "/var/lib/fleet-snapshots",
      pvc_size         | String | default = "5Gi",
      pvc_storage_class | String | default = "local-path",
      upload_schedule   | String | default = "*/30 * * * *",
      upload_image      | String | default = "ghcr.io/oras-project/oras:v1.3.0",
      upload_registry   | String | default = "daoreg.librecloud.online/libre-forge/fleet-state",
      upload_artifact_type | String | default = "application/vnd.libre-forge.fleet-state.v1+json",
    } | default = {},

    pki | {
      enabled            | Bool   | default = true,
      ca_duration        | String | default = "43800h",
      ca_renew_before    | String | default = "720h",
      ca_parent_issuer   | String | default = "buildkit-selfsigned-issuer",
      ca_common_name     | String | default = "Libre Daoshi Fleet CA",
      cert_duration      | String | default = "2160h",
      cert_renew_before  | String | default = "360h",
    } | default = {},

    netpol | {
      enabled                | Bool         | default = true,
      operator_ingress_cidrs | Array String | default = ["10.200.0.0/24"],
      cluster_internal_cidrs | Array String | default = ["10.0.0.0/16"],
      external_egress_https  | Bool         | default = true,
      nats_namespace         | String       | default = "core-service",
    } | default = {},

    l2_announcement | {
      enabled    | Bool         | default = false,
      interfaces | Array String | default = ["enp7s0"],
    } | default = {},

    prometheus_rule | {
      enabled  | Bool   | default = true,
      selector | String | default = "kube-prometheus",
    } | default = {},

    sops | {
      age_key_secret_ref | String,
    },

    requires | {
      storage | { size | String, persistent | Bool } | optional,
      ports   | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service  | String | optional,
      port     | Number | optional,
      protocol | String | optional,
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = true,
      health  | Bool | default = true,
      restart | Bool | default = true,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}