let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  RouteSpec = {
    host             | String,
    upstream         | String,
    port             | Number,
    tls_skip_verify  | Bool | default = false,
  },

  PrivateIngress = {
    context | _context_lib.ComponentContext | optional,

    name      | String,
    namespace | String | default = "ingress-private",

    # sozu proxy image — ghcr.io/sozu-proxy/sozu:<tag>
    image     | String,

    # sozuctl-sidecar image: alpine + inotify-tools + sozuctl binary.
    # Must be pre-built and pushed to reg.librecloud.online/cluster/sozuctl-sidecar.
    sidecar_image | String,

    # Cilium LB-IPAM private IP for the L4 LoadBalancer Service.
    # Must be in the 10.200.3.0/28 pool and not already assigned.
    private_lb_ip | String,

    # How TLS certificates are rotated:
    #   'csi_driver   — cert-manager CSI driver mounts certs as ephemeral tmpfs;
    #                   sozuctl sidecar hot-reloads sozu on file change (Pattern B).
    #                   Requires csi_driver_enabled = true in cert_manager component.
    #   'reloader     — cert-manager issues Certificate + Secret; stakater/Reloader
    #                   triggers rollout on Secret rotation.
    #   'sozu_managed — sozu's built-in ACME client manages certs natively.
    tls_rotation | [| 'csi_driver, 'reloader, 'sozu_managed |] | default = 'reloader,

    # ClusterIssuer to reference in CSI volume attributes (tls_rotation = 'csi_driver).
    cluster_issuer | String | default = "letsencrypt-prod-librecloud",

    # Host-based routes served by this ingress.
    # upstream: K8s Service FQDN (svc.libre-wuji.local) or ClusterIP.
    routes | Array RouteSpec | default = [],

    requires | {
      ports       | Array {
        port     | Number,
        exposure | [| 'public, 'private, 'internal |] | default = 'private,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = true,
      health  | Bool | default = true,
    } | default = {},

    live_check | {
      strategy | [| 'k8s_pods, 'http_get |] | default = 'k8s_pods,
      scope    | [| 'cp_only, 'all_nodes |] | default = 'cp_only,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}