let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      # Namespace first — all subsequent resources land here.
      { file = "namespace",           action = 'apply, skip_if_exists = true },

      # Shared content PVC — all sites share /opt/storage.
      # skip_if_exists preserves content on reinstall.
      { file = "pvc",                 action = 'apply, skip_if_exists = true },

      # CF API token secret in cert-manager namespace — required by ClusterIssuers.
      { action = 'create-cf-secret },

      # One ClusterIssuer per unique dns_zone across all sites.
      { file = "clusterissuers",      action = 'apply, skip_if_exists = true },

      # One Certificate per site — cert-manager provisions via DNS-01.
      { file = "certificates",        action = 'apply, skip_if_exists = true },

      # upstreams K8s Secret — generated from SOPS credentials, never a ConfigMap.
      # Contains auth credentials inline; encrypted at rest by etcd encryption.
      { action = 'create-credentials },

      { file = "fip-pool",            action = 'apply, skip_if_exists = true },
      { file = "configmap-main",      action = 'apply },
      { file = "deployment",          action = 'apply },
      { file = "service",             action = 'apply },

      {
        action = 'wait-ready,
        post   = [
          { action = 'protect-volume },
        ],
      },
    ],

    update = [
      # CF secret + certs: idempotent; picks up newly added sites.
      { action = 'create-cf-secret },
      { file = "certificates",        action = 'apply, skip_if_exists = true },

      { file = "configmap-main",      action = 'apply },
      # Regenerate upstreams Secret from _credentials.env — picks up auth changes.
      { action = 'create-credentials },
      {
        file   = "deployment",
        action = 'rollout-restart,
        delay  = 3,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],

    delete = [
      { file = "service",             action = 'delete },
      { file = "deployment",          action = 'delete },
      { action = 'delete-credentials },
      { file = "configmap-main",      action = 'delete },
    ],

    restart = [
      {
        file   = "deployment",
        action = 'rollout-restart,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],

    hooks = {
      # After a full init completes: register PVC for Longhorn daily snapshots.
      init = {
        post = [
          { action = 'backup-register },
        ],
      },
      # Before restarting: check cert readiness so operator is warned if stale certs
      # would be served during the window between restart and aralez reloading.
      restart = {
        pre = [
          { action = 'cert-status-check },
        ],
      },
    },
  },
}