let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  coredns | default = {
    mode     | default = 'taskserv,
    version        | default = "1.14.2",
    name           | default = "coredns",
    cmd_task       | default = "install",
    hostname       | default = "dns-server",
    etc_corefile   | default = "/etc/coredns/Corefile",
    nameservers    | default = [],
    domains_search | default = "",
    entries | default = [
      {
        kind              | default = 'forward,
        domain            | default = ".",
        port              | default = 53,
        bind              | default = null,
        file              | default = null,
        records           | default = [],
        forward | default = {
          source      | default = ".",
          forward_ip  | default = null,
        },
        use_log            | default = true,
        use_errors         | default = true,
        use_cache          | default = true,
        etcd_cluster_name  | default = "",
      },
    ],
    operations | default = {
      install   = true,
      reinstall = true,
      delete    = false,
      health    = true,
    },
    # scope=all_servers: coredns runs as a binary resolver on every node.
    # Workspace can override scope=cp_only if coredns only runs on CP.
    live_check | default = {
      strategy  = 'systemd,
      scope     = 'all_servers,
      service   = "coredns",
      aggregate = 'all_must_pass,
    },

    # ServiceConcerns default — internal DNS server; dns_provider preset with custom backup tracking.
    concerns | default = _presets.dns_provider & {
      tls    | force = { kind = 'disabled, reason = "DNS-over-TLS not enabled at this layer" },
      backup | force = {
        kind        = 'pending,
        reason      = "zone files captured by SystemBackupDef.external_coredns at workspace level",
        backlog_ref = "BACKUP-DNS-COREDNS-001",
      },
    },
  },
}