let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  k0s | default = {
    mode     | default = 'taskserv,
    version       | default = "1.35.3+k0s.0",
    role          | default = 'controller_worker,
    data_dir      | default = "/var/lib/k0s",
    disable_ipv6  | default = true,
    cluster_name        | default = "k0s",
    disable_kube_proxy  | default = true,
    storage_backend     | default = 'sqlite,
    kine_dir            | default = "",
    # k0sctl profile fields
    k0sctl_version              | default = "v0.29.0",
    api_extra_sans              | default = [],
    ssh_user                    | default = "root",
    ssh_port                    | default = 22,
    ssh_key_path                | default = "",
    wait_enabled                | default = true,
    drain_enabled               | default = false,
    drain_grace_period          | default = "2m0s",
    drain_timeout               | default = "5m0s",
    drain_force                 | default = true,
    concurrency_limit           | default = 5,
    worker_disruption_percent   | default = 10,
    concurrency_uploads         | default = 3,
    operations | default = {
      install   = true,
      reinstall = true,
      delete    = true,
      health    = true,
    },
    live_check | default = {
      strategy = 'k8s_api,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — k0s; stateless preset with custom tls/certs/backup reasons.
    concerns | default = _presets.stateless & {
      tls    | force = { kind = 'disabled, reason = "k0s manages its own TLS material; PKI captured by SystemBackupDef.host_configs" },
      certs  | force = { kind = 'disabled, reason = "ACME issuance handled by cert-manager component, not k0s" },
      backup | force = { kind = 'disabled, reason = "data_dir captured by SystemBackupDef.host_configs (configured at workspace level for active k0s deployments)" },
    },
  },
}