{
  fleet_daemon | default = {
    name      | default = "fleet-daemon",
    version   | default = "0.1.0",
    image_ref | default = "oci://daoreg.librecloud.online/libre-forge/fleet-daemon:0.1.0",
    mode      | default = 'cluster,

    deployment | default = {
      kind      = 'kube_workload,
      namespace = "fleet-system",
      replicas  = 1,
      service   = {
        port             = 19012,
        tls_secret_ref   = "fleet-daemon-tls",
        channel_nodeport | default = 0,
      },
      resources = {
        requests = { cpu = "100m", memory = "128Mi" },
        limits   = { cpu = "500m", memory = "512Mi" },
      },
    },

    tick_interval_seconds | default = 30,

    snapshot | default = {
      interval_seconds  = 300,
      retain_seconds    = 86400,
      local_path        = "/var/lib/fleet-snapshots",
      pvc_size          = "5Gi",
      pvc_storage_class = "local-path",
      upload_schedule   = "*/30 * * * *",
      upload_image      = "ghcr.io/oras-project/oras:v1.3.0",
      upload_registry   = "daoreg.librecloud.online/libre-forge/fleet-state",
      upload_artifact_type = "application/vnd.libre-forge.fleet-state.v1+json",
    },

    pki | default = {
      enabled           = true,
      ca_duration       = "43800h",
      ca_renew_before   = "720h",
      ca_parent_issuer  = "buildkit-selfsigned-issuer",
      ca_common_name    = "Libre Daoshi Fleet CA",
      cert_duration     = "2160h",
      cert_renew_before = "360h",
    },

    netpol | default = {
      enabled                = true,
      operator_ingress_cidrs = ["10.200.0.0/24"],
      cluster_internal_cidrs = ["10.0.0.0/16"],
      external_egress_https  = true,
      nats_namespace         = "core-service",
    },

    l2_announcement | default = {
      enabled    = false,
      interfaces = ["enp7s0"],
    },

    prometheus_rule | default = {
      enabled  = true,
      selector = "kube-prometheus",
    },

    requires | default = {
      ports = [
        { port = 19012, exposure = 'internal },
      ],
      credentials = [
        "FORGE_CONTROL_SEED",
        "FLEET_AGE_KEY",
        "DAOREG_PULL_USERNAME",
        "DAOREG_PULL_PASSWORD",
        "DAOREG_PUSH_USERNAME",
        "DAOREG_PUSH_PASSWORD",
      ],
    },

    provides | default = {
      service  = "fleet-daemon",
      port     = 19012,
      protocol = "http",
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      health  = true,
      restart = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },
  },
}