let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  rev_proxy | default = {
    name          | default = "rev-proxy",
    namespace     | default = "rvprxy",
    catalog_ref   | default = "rev_proxy",
    image         | default = "sadoyan/aralez",
    image_tag     | default = "latest",
    fip_name      | default = "librecloud-fip-rvprxy",
    http_port     | default = 6193,
    https_port    | default = 6194,
    config_port   | default = 3000,
    storage_class | default = "longhorn-retain",
    storage_size  | default = "2Gi",
    data_dir      | default = "/opt/storage",
    acme_email    | default = "",
    sites         | default = [],

    requires | default = {
      storage     = { size = "2Gi", persistent = true },
      ports       = [
        { port = 6193, exposure = 'public },
        { port = 6194, exposure = 'public },
      ],
      credentials = [],
    },

    provides | default = {
      service   = "rev-proxy",
      port      = 6193,
      endpoints = [],
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      health  = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # Shared proxy — certs are per-site, managed individually in manifests.
    # The preset is used for the shared TLS concern metadata; hostnames = []
    # since each site has its own Certificate resource.
    concerns | default =
      let _name       = name in
      let _acme_email = acme_email in
      (_presets.tls_endpoint_with_acme {
        tls_secret         = "%{_name}-tls",
        cluster_issuer     = "letsencrypt-prod",
        hostnames          = [],
        dns_internal       = [],
        dns_zone           = "",
        acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
        acme_email         = _acme_email,
        cert_secret_ref    = "",
        cert_provider      = 'cloudflare,
        backup_backlog_ref = "BACKUP-RVPRXY-001",
      }) & {
        backup | force = {
          kind        = 'pending,
          reason      = "Shared content PVC covered by cluster-level backup policy",
          backlog_ref = "BACKUP-RVPRXY-001",
        },
        manifest_hooks = {
          init   = { pre = [
            { action = 'create-cf-secret },
            { file = "clusterissuers",  action = 'apply, skip_if_exists = true },
            { file = "certificates",    action = 'apply, skip_if_exists = true },
          ] },
          update = { pre = [
            { file = "certificates",    action = 'apply, skip_if_exists = true },
          ] },
          delete = { pre = [] },
        },
      },
  },
}