let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  Forgejo = {
    context | _context_lib.ComponentContext | optional,

    name      | String,
    version   | String | default = "9.0.3",
    image     | String | default = "codeberg.org/forgejo/forgejo:9.0.3",
    namespace | String | default = "data",

    http_port    | Number | default = 3000,
    ssh_port     | Number | default = 22,
    # NodePort exposed for SSH git access. Range 30000-32767 (K8s default).
    # When deploying multiple Forgejo instances in the same cluster, pick a
    # unique nodeport per tenant (e.g. 32222 / 32223 / 32224).
    ssh_nodeport | Number | default = 32222,

    domain         | String | default = "",
    domains_extra  | Array String | default = [],
    # Overrides SSH_DOMAIN advertised to git clients. Defaults to `domain` when empty.
    # Set when SSH is exposed via a different hostname than the web UI (e.g. dedicated NodePort IP/CNAME).
    ssh_domain     | String | default = "",
    dns_zone       | String | default = "",
    acme_email     | String | default = "",
    cluster_issuer | String | default = "letsencrypt-prod",

    gateway_fip  | String | default = "",
    gateway_name | String | default = "libre-wuji",
    gateway_ns   | String | default = "kube-system",

    # When set, SSH service becomes LoadBalancer sharing this FIP IP via Cilium LB-IPAM.
    # Requires the gateway service to have sharing-cross-namespace including this namespace.
    # When empty, falls back to NodePort using ssh_nodeport.
    ssh_lb_ip           | String | default = "",
    ssh_lb_sharing_key  | String | default = "",

    db_name   | String | default = "forgejo",
    db_schema | String | default = "",
    db_host   | String | default = "postgresql.core-data.svc.libre-wuji.local",
    db_user | String | default = "forgejo",
    db_port | Number | default = 5432,

    data_dir  | String | default = "/var/lib/gitea",
    repos_dir | String | default = "/var/lib/gitea/git/repositories",

    admin_user  | String | default = "admin",
    admin_email | String | default = "",

    storage_class | String | default = "longhorn-retain",
    storage_size  | String | default = "20Gi",

    registry_secret | String | default = "",

    # Extra app.ini fragments appended to the rendered ConfigMap.
    # Used to inject per-tenant overrides without rebuilding the template.
    app_ini_extra | String | default = "",

    mode | [| 'taskserv, 'cluster, 'container |] | default = 'cluster,

    requires | {
      storage | { size | String, persistent | Bool } | optional,
      ports   | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      databases | Array String | default = [],
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install   | Bool | default = true,
      update    | Bool | default = false,
      reinstall | Bool | default = false,
      delete    | Bool | default = false,
      backup    | Bool | default = false,
      restore   | Bool | default = false,
      health    | Bool | default = false,
      config    | Bool | default = false,
      scripts   | Bool | default = false,
      restart   | Bool | default = false,
    } | default = {},

    live_check | {
      strategy | [| 'k8s_pods, 'http_get |] | default = 'k8s_pods,
      scope    | [| 'cp_only, 'all_nodes |] | default = 'cp_only,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}