let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  Relay = {
    host | String,
    port | Number | default = 587,
    tls  | Bool   | default = true,
    name | String | default = "ses",
  },

  DockerMailserver = {
    name             | String,
    version          | String,
    image            | String,
    gui_version      | String,
    gui_image        | String,
    namespace        | String | default = "mail",
    hostname         | String,
    domain           | String,
    node             | String,
    lb_ipam_ip       | String,
    private_lb_ip    | String | default = "",
    private_cidr     | String | default = "",
    tls_secret       | String | default = "docker-mailserver-tls",
    cluster_issuer   | String | default = "letsencrypt-prod",
    storage_class    | String | default = "hcloud-volumes",
    mode             | [| 'cluster |] | default = 'cluster,

    smtp_port        | Number | default = 25,
    imap_port        | Number | default = 143,
    smtps_port       | Number | default = 465,
    submission_port  | Number | default = 587,
    imaps_port       | Number | default = 993,
    pop3s_port       | Number | default = 995,
    gui_port         | Number | default = 80,

    enable_rspamd       | String | default = "1",
    enable_clamav       | String | default = "0",
    enable_fail2ban     | String | default = "0",
    enable_spamassassin | String | default = "0",
    enable_postgrey     | String | default = "0",
    enable_pop3         | String | default = "0",
    postgrey_delay      | String | default = "300",

    postmaster_address | String | default = "",
    fail2ban_blocktype  | String       | default = "drop",
    fail2ban_ignoreip  | Array String | default = [],
    spam_to_inbox      | String | default = "0",
    move_spam_to_junk  | String | default = "1",
    sa_tag             | String | default = "2.0",
    sa_tag2            | String | default = "6.31",
    sa_kill            | String | default = "10.0",
    log_level          | String | default = "warn",

    relay | Relay,

    requires | {
      storage | {
        mail_data | { size | String, persistent | Bool },
      } | optional,
      ports | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      ports     | Array Number | default = [],
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install   | Bool | default = true,
      update    | Bool | default = false,
      reinstall | Bool | default = false,
      delete    | Bool | default = false,
      backup    | Bool | default = false,
      restore   | Bool | default = false,
      health    | Bool | default = false,
      config    | Bool | default = false,
      restart   | Bool | default = false,
    } | default = {},

    # When true, deployment includes a dkim-publisher sidecar that publishes the
    # DKIM TXT key to the configured external DNS endpoint. Requires the PVC mount
    # at /tmp/docker-mailserver/opendkim/keys/ to be readable by the sidecar UID
    # (different from the docker-mailserver container — typically needs explicit
    # PVC permissions or fsGroup tuning). Default off to avoid CrashLoop on first
    # install when DKIM keys haven't been generated yet.
    dkim_publisher_enabled | Bool | default = false,

    dns_records | {
      domain        | String,
      hostname      | String,
      mx            | Array { priority | Number, value | String },
      spf           | String,
      dmarc | {
        policy | [| 'none, 'quarantine, 'reject |],
        rua    | String | optional,
        ruf    | String | optional,
        adkim  | [| 's, 'r |] | default = 's,
        aspf   | [| 's, 'r |] | default = 's,
        pct    | Number | default = 100,
      },
      autoconfig    | String | optional,
      dkim_selector | String | default = "mail",
    } | optional,

    # ServiceConcerns umbrella (ADR-008). The defaults.ncl provides a baseline
    # derived from existing tls_secret/cluster_issuer/cert/dns_records so the
    # field is auto-populated when not explicitly overridden. Workspace-level
    # declarations in infra/libre-wuji/components/docker-mailserver.ncl can
    # override individual concerns (e.g. enable backup with a BackupPolicy).
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}