let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  SmbStorageClass = {
    name
      | String
      | doc "Name for the provisioned StorageClass",

    source
      | String
      | doc "UNC path to the SMB share, e.g. //u123456.your-storagebox.de/backup",

    secret_name
      | String
      | doc "K8s Secret holding 'username' and 'password' keys for the SMB share — provisioned out-of-band (SOPS-managed)",

    secret_namespace
      | String
      | doc "Namespace of secret_name"
      | default = "kube-system",

    reclaim_policy
      | std.enum.TagOrString
      | doc "PersistentVolume reclaim policy"
      | default = 'Retain,

    mount_options
      | Array String
      | doc "CIFS mount options. vers pinned explicitly — do not rely on negotiated default across SMB server versions."
      | default = ["dir_mode=0777", "file_mode=0777", "vers=3.0"],
  },

  CsiDriverSmb = {
    mode
      | std.enum.TagOrString
      | doc "Deployment mode — csi-driver-smb is always a taskserv (controller Deployment + node DaemonSet)"
      | default = 'taskserv,

    version
      | String
      | doc "csi-driver-smb release tag (github.com/kubernetes-csi/csi-driver-smb releases)"
      | default = "v1.20.1",

    namespace
      | String
      | doc "K8s namespace for the controller Deployment + node DaemonSet"
      | default = "kube-system",

    driver_name
      | String
      | doc "CSI driver name as registered with kubelet — fixed by upstream, not configurable in practice"
      | default = "smb.csi.k8s.io",

    kubelet_dir
      | String
      | doc "Host kubelet data directory the csi-smb-node DaemonSet binds for NodeStage/NodePublish and plugin registration. kubeadm uses /var/lib/kubelet (default); k0s uses /var/lib/data/k0s/kubelet. A wrong value makes NodeStage mount into a path kubelet never reads, so every PVC silently falls back to an empty local dir — see qa daoshi-hcloud-csi-kubeletdir-incident (same failure mode hit hetzner_csi on this fleet)."
      | default = "/var/lib/kubelet",

    storage_classes
      | Array SmbStorageClass
      | doc "StorageClasses to create against this driver, one per SMB share/credential pair"
      | default = [],

    operations
      | { install: Bool, reinstall: Bool, delete: Bool, health: Bool }
      | optional,

    live_check
      | { strategy: std.enum.TagOrString, scope: std.enum.TagOrString, namespace: String, selector: String }
      | optional,

    # ServiceConcerns umbrella (ADR-008).
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}