let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  stalwart | default = {
    name           | default = "stalwart",
    version        | default = "0.16.0",
    image          | default = "ghcr.io/stalwartlabs/stalwart:v0.16.0",
    namespace      | default = "mail",
    hostname       | default = "mail.example.com",
    domain         | default = "example.com",
    data_dir       | default = "/var/lib/stalwart",
    node           | default = "",
    lb_ipam_ip     | default = "",
    tls_secret     | default = "stalwart-tls",
    cluster_issuer | default = "letsencrypt-prod",
    storage_class  | default = "hcloud-volumes",
    mode           | default = 'cluster,

    smtp_port       | default = 25,
    smtps_port      | default = 465,
    submission_port | default = 587,
    imaps_port      | default = 993,
    http_port       | default = 8080,

    relay = {
      host | default = "",
      port | default = 587,
      tls  | default = true,
      name | default = "ses",
    },

    requires | default = {
      storage     = { size = "20Gi", persistent = true },
      ports = [
        { port = 25,  exposure = 'public },
        { port = 465, exposure = 'public },
        { port = 587, exposure = 'public },
        { port = 993, exposure = 'public },
        { port = 8080, exposure = 'internal },
      ],
      credentials = ["RELAY_USERNAME", "RELAY_PASSWORD", "ADMIN_PASSWORD"],
    },

    provides | default = {
      service   = "stalwart",
      ports     = [25, 465, 587, 993],
      endpoints = [],
    },

    operations | default = {
      install  = true,
      update   = true,
      delete   = true,
      backup   = true,
      restore  = true,
      health   = true,
      config   = true,
      restart  = true,
    },

    # ServiceConcerns default — Stalwart mail server; tls_endpoint_with_acme preset.
    concerns | default = (_presets.tls_endpoint_with_acme {
      tls_secret         = "stalwart-tls",
      cluster_issuer     = "letsencrypt-prod",
      hostnames          = [],
      dns_internal       = [],
      dns_zone           = "",
      acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
      acme_email         = "",
      cert_secret_ref    = "",
      cert_provider      = 'cloudflare,
      backup_backlog_ref = "BACKUP-STALWART-001",
    }) & {
      backup | force = {
        kind        = 'pending,
        reason      = "BackupPolicy declared at workspace level (mail data + DB; per-domain or per-mailbox scopes)",
        backlog_ref = "BACKUP-STALWART-001",
      },
    },
  },
}