let version  = import "./version.ncl" in
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  cert_manager | default = {
    version         | default = version.CERT_MANAGER_VERSION,
    namespace       | default = "cert-manager",
    cluster_issuers     | default = [],
    mode                | default = 'cluster,
    csi_driver_enabled  | default = false,
    csi_driver_version  | default = "v0.7.1",

    live_check | default = {
      strategy  = 'k8s_pods,
      namespace = "cert-manager",
      selector  = "cert-manager",
    },

    # ServiceConcerns default — cert-manager generates TLS material consumed
    # by other components; itself has no application data.
    # infra_storage_managed preset with custom tls/certs/backup reasons.
    concerns | default = _presets.infra_storage_managed & {
      tls    | force = { kind = 'disabled, reason = "cert-manager generates TLS material; does not terminate TLS itself" },
      certs  | force = { kind = 'disabled, reason = "ACME issuer config is per-consumer; cert-manager hosts the controller only" },
      backup | force = { kind = 'disabled, reason = "cluster_resources captured by SystemBackupDef.tls_certmanager (Secrets, Certificates, ClusterIssuers)" },
    },
  },
}