let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  woodpecker | default = {
    name         | default = "woodpecker",
    version      | default = "latest",
    image_server | default = "woodpecker/server:latest",
    image_agent  | default = "woodpecker/agent:latest",
    namespace    | default = "data",
    http_port    | default = 8000,
    grpc_port    | default = 9000,
    database     | default = "woodpecker",
    db_host      | default = "postgresql.data.svc",
    forgejo_url  | default = "http://forgejo.data.svc:3000",
    forgejo_client | default = "",
    admin          | default = "",
    hostname     | default = "",
    cluster_issuer | default = "letsencrypt-prod-librecloud",
    tls_secret   | default = "woodpecker-tls",
    gateway_name | default = "libre-daoshi",
    gateway_ns   | default = "kube-system",
    acme_email   | default = "",
    dns_zone     | default = "",
    cert_secret_ref | default = "dns-librecloud-online",
    mode         | default = 'cluster,

    requires | default = {
      storage = { size = "5Gi", persistent = true },
      ports   = [
        { port = 80,  exposure = 'public },
        { port = 443, exposure = 'public },
      ],
      credentials = ["WOODPECKER_AGENT_SECRET", "WOODPECKER_FORGEJO_SECRET", "POSTGRES_PASSWORD"],
    },

    provides | default = {
      service = "woodpecker",
      port    = 8000,
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      health  = true,
    },
    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — public Woodpecker CI; tls_endpoint_with_acme preset.
    concerns | default = (_presets.tls_endpoint_with_acme {
      tls_secret         = "woodpecker-tls",
      cluster_issuer     = "letsencrypt-prod",
      hostnames          = [],
      dns_internal       = [],
      dns_zone           = "",
      acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
      acme_email         = "",
      cert_secret_ref    = "",
      cert_provider      = 'cloudflare,
      backup_backlog_ref = "BACKUP-WOODPECKER-001",
    }) & {
      backup | force = {
        kind        = 'pending,
        reason      = "BackupPolicy declared at workspace level (DB + agent state)",
        backlog_ref = "BACKUP-WOODPECKER-001",
      },
    },
  },
}