let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  lian_node | default = {
    name    | default = "lian_node",
    version | default = "0.1.0",
    mode    | default = 'persistent_vm,

    live_check | default = { strategy = 'on_demand },

    # Per-instance — caller MUST override. Install script rejects "UNSET" sentinel.
    logical_id    | default = "UNSET",
    target_server | default = "UNSET",
    private_ip    | default = "0.0.0.0",

    buildkit_version | default = "v0.29.0",
    sccache_version  | default = "v0.9.1",
    nushell_version  | default = "0.112.2",
    just_version     | default = "1.51.0",
    oras_version     | default = "1.3.2",

    tls | default = {
      domain          = "fleet.librecloud.online",
      cert_path       = "/etc/buildkit/tls/server.crt",
      ca_path         = "/etc/buildkit/tls/ca.crt",
      key_path        = "/etc/buildkit/tls/server.key",
      tcp_listen_port = 1234,
      reload_hook     = "systemctl reload-or-restart buildkitd",
    },

    default_size | default = {
      cpu       = 2,
      memory_gb = 4,
      disk_gb   = 40,
    },

    storage | default = {
      persistent        = true,
      sccache_disk_path = "/var/cache/sccache",
      buildkit_root     = "/var/lib/buildkit",
    },

    hcloud | default = {
      server_type = "cax11",
      location    = "fsn1",
    },

    ssh | default = {
      authorized_keys_secret = "lian-node-authorized-keys",
    },

    registries | default = [],

    # Standalone buildkit nodes default to swap=disabled (preserve current
    # host state). Workspaces opt in to file-backed swap when the node is
    # NOT also a cluster worker (see ADR-002 separation).
    swap | default = {
      mode               = 'preserve,
      size_gb            = 8,
      path               = "/swapfile",
      swappiness         = 10,
      vfs_cache_pressure = 50,
    },

    requires | default = {
      credentials  = [],
      capabilities = ["vm-lifecycle", "ssh-access"],
    },

    provides | default = {
      service   = "lian_node",
      interface = "buildkit-persistent",
    },

    operations | default = {
      install = true,
      update  = true,
      health  = true,
    },

    # ServiceConcerns default — persistent node:
    #   - backup matters (disk + sccache cache may justify periodic snapshot)
    #   - tls disabled at buildkit layer (binds unix socket; clients tunnel via SSH or
    #     access via private network — same boundary argument as buildkit_runner)
    concerns | default = _presets.infrastructure_glue & {
      tls    | force = { kind = 'enabled, reason = "buildkitd serves TCP with Let's Encrypt certs issued+renewed by acme_certd; reload_hook keeps key material fresh" },
      backup | force = { kind = 'pending, reason = "persistent disk holds sccache + buildkit layers; snapshot policy to be decided per-fleet" },
    },
  },
}