let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  buildkit_runner | default = {
    name    | default = "buildkit_runner",
    version | default = "1.0.0",
    mode    | default = 'ephemeral_vm,

    live_check | default = { strategy = 'on_demand },

    golden_image_name         | default = "buildkit-runner-golden",
    golden_image_rebuild_cron | default = "0 3 * * 0",

    default_size | default = {
      cpu       = 4,
      memory_gb = 8,
      disk_gb   = 40,
    },

    storage | default = {
      persistent = false,
    },

    hcloud | default = {
      server_type_pool = ["cax21", "cax31", "cax41", "ccx13"],
      location         = "fsn1",
    },

    ssh | default = {
      orchestrator_pubkey_secret = "orchestrator-ssh-pubkey",
    },

    lease | default = {
      max_duration_min = 60,
    },

    requires | default = {
      credentials  = ["HCLOUD_TOKEN", "ORCHESTRATOR_SSH_PUBKEY"],
      capabilities = ["vm-lifecycle", "image-storage-s3", "ssh-access"],
    },

    provides | default = {
      service   = "buildkit_runner",
      interface = "buildkit-runner",
    },

    operations | default = {
      install = true,
      health  = true,
    },

    # ServiceConcerns default — buildkit-runner; ephemeral by design (ADR-039).
    # infrastructure_glue preset with custom tls/backup reasons.
    # ── Access-model asymmetry with buildkit_lite (intentional, do not converge) ──
    # buildkit_lite: persistent K8s Deployment exposed via VPN+NodePort → requires mTLS
    #                (anyone on the wuwei network could otherwise dial the daemon).
    # buildkit_runner: per-build ephemeral Hetzner VM; buildkitd listens on unix socket
    #                only; orchestrator opens an SSH tunnel using ssh.orchestrator_pubkey_secret;
    #                the SSH session itself IS the authentication boundary, so a second
    #                TLS layer would add no benefit. cloud-init/runner.yaml line 33:
    #                ExecStart=/usr/local/bin/buildkitd --addr unix:///run/buildkit/buildkitd.sock
    concerns | default = _presets.infrastructure_glue & {
      tls    | force = { kind = 'disabled, reason = "buildkitd binds unix socket only; orchestrator SSH tunnel provides the auth boundary — no TCP surface, no mTLS surface" },
      backup | force = { kind = 'disabled, reason = "ephemeral by design (ADR-039); persistent state captured by SystemBackupDef.builder_env" },
    },
  },
}