# Contract for the backup_manager component instance configuration.
# Consumed by the cluster install script via env-backup_manager.j2.

{
  BackupManager = {
    name              | String,
    namespace         | String | doc "K8s namespace for the daemon Deployment" | default = "backup-system",
    mode              | [| 'cluster |] | default = 'cluster,

    # Daemon Deployment parameters
    daemon_replicas   | Number | doc "Single replica today (HA via leader election deferred)" | default = 1,
    daemon_image      | String,
    daemon_http_port  | Number | default = 9099,
    daemon_metrics_port | Number | default = 9100,

    # Mount Pod (ephemeral, not 24/7)
    mount_image       | String,

    # Vault wiring (ADR-017)
    vault_endpoint    | String,
    vault_bootstrap_secret_ref | String | doc "K8s Secret holding the bootstrap NKey/JWT for first-time vault auth",

    # NATS wiring (ADR-016)
    nats_url          | String,
    nats_topology_ref | String | doc "Path to the NATS topology Nickel file (declarative streams + consumers)",

    # Workspace policy paths (consumed by daemon at startup + on watcher reload)
    policies = {
      components_path      | String | doc "Glob pattern for component .ncl files" | default = "infra/libre-wuji/components/*.ncl",
      groups_path          | String | doc "Path to backup-groups.ncl" | default = "infra/libre-wuji/backup-groups.ncl",
      system_backups_path  | String | doc "Path to system-backups.ncl" | default = "infra/libre-wuji/system-backups.ncl",
      verify_recipes_path  | String | doc "Directory with DrillSpec recipes" | default = "infra/libre-wuji/verify-recipes",
      nickel_import_path   | String | default = "/opt/provisioning",
    },

    # Concurrency budgets
    concurrency = {
      max_parallel_backups          | Number | default = 4,
      max_parallel_per_destination  | Number | default = 2,
    },

    # On-host installation: where to deploy the binary for SystemBackupDef
    # consumers (etcd, k8s_certs, vault_state, host_configs). The wrapper
    # provisioning installer copies the prvng-backup binary via SSH.
    host_install = {
      binary_path  | String | default = "/usr/local/bin/prvng-backup",
      cron_dir     | String | default = "/etc/cron.d",
      systemd_dir  | String | default = "/etc/systemd/system",
      env_dir      | String | default = "/etc/prvng-backup",
    },

    # Required Secrets injected into the daemon Pod (via envFrom.secretRef).
    # Contents are populated at install time by the wrapper from SOPS+Age
    # bootstrap secrets; the daemon then promotes them into vault for
    # subsequent runs (ADR-017).
    requires = {
      storage     | { size | String, persistent | Bool } | default = { size = "5Gi", persistent = true },
      ports       | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [
        { port = 9099, exposure = 'internal },
        { port = 9100, exposure = 'internal },
      ],
      credentials | Array String | default = [
        "VAULT_BOOTSTRAP_TOKEN",
        "NATS_BOOTSTRAP_NKEY_SEED",
        "BACKUP_AGE_KEY",                    # bootstrap age key for vault_state recovery
        "BACKUP_S3_PRIMARY_ACCESS_KEY",
        "BACKUP_S3_PRIMARY_SECRET_KEY",
        "BACKUP_B2_REPLICA_KEY_ID",
        "BACKUP_B2_REPLICA_APPLICATION_KEY",
      ],
    },

    provides = {
      service   | String | default = "backup-manager",
      port      | Number | default = 9099,
      endpoints | Array String | default = ["/metrics", "/api/v1/policy", "/api/v1/queue"],
    },

    operations = {
      install   | Bool | default = true,
      update    | Bool | default = true,
      delete    | Bool | default = true,
      health    | Bool | default = true,
      restart   | Bool | default = true,
    },
  },
}