let mp = import "schemas/lib/manifest_plan.ncl" in

# NOTE (bl-005 / adr-018): when taskserv.host_network = true, the
# templates lb-ipam-pool.yaml.j2 and service-vpn.yaml.j2 render empty.
# The blank-skip logic in wireguard-lib.sh::_plan_is_blank turns the
# corresponding 'apply / 'delete actions into no-ops. Steady-state plan
# requires no host_network branching.
# One-shot migration cleanup (delete pre-existing CiliumLBIPPool +
# wireguard-vpn Service when flipping host_network false→true) is a
# cutover-time operator action documented in bl-005 SubT 5/18, not in
# this plan — plans describe steady state, not transitions.
{
  manifest_plan | mp.ManifestPlan = {
    init = [
      { file = "namespace",     action = 'apply, skip_if_exists = true },
      { action = 'bootstrap-keypair },
      { action = 'create-credentials },
      { file = "pvc",           action = 'apply, skip_if_exists = true },
      { file = "configmap-env", action = 'apply },
      { file = "deployment",    action = 'apply },
      { file = "lb-ipam-pool",  action = 'apply, skip_if_exists = true },
      { file = "service-vpn",   action = 'apply },
      { file = "service-ui",    action = 'apply },
      {
        action = 'wait-ready,
        post   = [
          { action = 'protect-volume, params = { pvc = "wireguard-data" } },
        ],
      },
    ],
    update = [
      { file = "configmap-env", action = 'apply },
      { file = "lb-ipam-pool",  action = 'apply },
      { file = "service-vpn",   action = 'apply },
      { file = "service-ui",    action = 'apply },
      { file = "deployment",    action = 'apply },
      {
        file   = "deployment",
        action = 'rollout-restart,
        delay  = 3,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],
    delete = [
      { file = "deployment",    action = 'delete },
      { file = "service-vpn",   action = 'delete },
      { file = "service-ui",    action = 'delete },
      { file = "configmap-env", action = 'delete },
      { file = "lb-ipam-pool",  action = 'delete },
    ],
    restart = [
      {
        file   = "deployment",
        action = 'rollout-restart,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],
  },
}