let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      # Namespace first — all subsequent resources land here.
      { file = "namespace",      action = 'apply, skip_if_exists = true },

      # PVC for static content — always provisioned, skip_if_exists preserves data on reinstall.
      { file = "pvc",            action = 'apply, skip_if_exists = true },

      # CF API token secret in cert-manager namespace — required by ClusterIssuer.
      { action = 'create-cf-secret },

      # ClusterIssuer and Certificate — DNS-01 via Cloudflare.
      { file = "clusterissuer",  action = 'apply, skip_if_exists = true },
      { file = "certificate",    action = 'apply, skip_if_exists = true },

      # ConfigMap carrying the nginx.conf server block.
      { file = "configmap",      action = 'apply },

      # htpasswd Secret — created from SOPS credentials; no-op if auth_paths is empty.
      { action = 'create-htpasswd },

      { file = "deployment",     action = 'apply },
      { file = "service",        action = 'apply },
      { file = "httproute",      action = 'apply },

      {
        action = 'wait-ready,
        post   = [
          # Lock the data PVC against accidental deletion via the ops controller.
          { action = 'protect-volume },
        ],
      },
    ],

    update = [
      # Re-apply cert for domain changes; skip existing to avoid rotation.
      { file = "certificate",    action = 'apply, skip_if_exists = true },

      { file = "configmap",      action = 'apply },
      { action = 'create-htpasswd },
      { file = "httproute",      action = 'apply },
      {
        file   = "deployment",
        action = 'rollout-restart,
        delay  = 3,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],

    delete = [
      { file = "httproute",      action = 'delete },
      { file = "deployment",     action = 'delete },
      { action = 'delete-htpasswd },
      { file = "service",        action = 'delete },
      { file = "configmap",      action = 'delete },
    ],

    restart = [
      {
        file   = "deployment",
        action = 'rollout-restart,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],
  },
}