let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  AcmeCertd = {
    name    | String,
    version | String,
    mode    | [| 'systemd_timer |],

    acme_sh_version | String,

    # ACME server endpoint — letsencrypt | letsencrypt_test | zerossl
    server | [| 'letsencrypt, 'letsencrypt_test, 'zerossl |] | default = 'letsencrypt,

    # acme.sh DNS plugin name — e.g. dns_cf (Cloudflare), dns_he, dns_aws
    dns_provider | String,

    # SOPS ref to the DNS API token resolved at deploy time
    dns_token_ref | String,

    # Domains to issue — supports wildcards (e.g. "*.librecloud.online")
    domains | Array String,

    # Email for ACME account registration and expiry notifications
    acme_email | String,

    # Directory where issued certs are installed
    cert_dir | String | default = "/etc/ssl/acme",

    # systemd timer interval for renewal checks
    renewal_check | String | default = "12h",

    # OS user acme.sh runs as (created if absent)
    user  | String | default = "acme",
    group | String | default = "acme",

    # Commands to run after a successful renewal (e.g. systemctl reload nginx)
    reload_hooks | Array String | default = [],

    requires | {
      credentials  | Array String | default = [],
      capabilities | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      interface | String | optional,
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = false,
      health  | Bool | default = true,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}