let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  forgejo | default = {
    name      | default = "forgejo",
    version   | default = "9.0.3",
    image     | default = "codeberg.org/forgejo/forgejo:9.0.3",
    namespace | default = "data",

    http_port    | default = 3000,
    ssh_port     | default = 22,
    ssh_nodeport | default = 32222,

    domain         | default = "",
    domains_extra  | default = [],
    ssh_domain     | default = "",
    dns_zone       | default = "",
    acme_email     | default = "",
    cluster_issuer | default = "letsencrypt-prod",

    gateway_fip  | default = "",
    gateway_name | default = "libre-wuji",
    gateway_ns   | default = "kube-system",

    ssh_lb_ip          | default = "",
    ssh_lb_sharing_key | default = "",

    db_name   | default = "forgejo",
    db_schema | default = "",
    db_host   | default = "postgresql.core-data.svc.libre-wuji.local",
    db_user | default = "forgejo",
    db_port | default = 5432,

    data_dir  | default = "/var/lib/gitea",
    repos_dir | default = "/var/lib/gitea/git/repositories",

    admin_user  | default = "admin",
    admin_email | default = "",

    storage_class | default = "longhorn-retain",
    storage_size  | default = "20Gi",

    registry_secret | default = "",

    app_ini_extra | default = "",

    mode | default = 'cluster,

    requires | default = {
      storage = { size = "20Gi", persistent = true },
      ports   = [
        { port = 3000,  exposure = 'internal },
        { port = 22,    exposure = 'public },
      ],
      credentials = [
        "FORGEJO_ADMIN_PASSWORD",
        "POSTGRES_PASSWORD",
        "FORGEJO_SECRET_KEY",
        "FORGEJO_INTERNAL_TOKEN",
        "FORGEJO_JWT_SECRET",
        "FORGEJO_LFS_JWT_SECRET",
      ],
    },

    provides | default = {
      service = "forgejo",
      port    = 3000,
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      health  = true,
      restart = true,
    },

    live_check | default =
      let _sel = name in
      {
        strategy = 'k8s_pods,
        scope    = 'cp_only,
        selector = _sel,
      },

    concerns | default =
      let _name           = name in
      let _domain         = domain in
      let _domains_extra  = domains_extra in
      let _dns_zone       = dns_zone in
      let _acme_email     = acme_email in
      let _cluster_issuer = cluster_issuer in
      let _backup_ref     = "BACKUP-FORGEJO-%{_name}" in
      (_presets.tls_endpoint_with_acme {
        tls_secret         = "%{_name}-tls",
        cluster_issuer     = _cluster_issuer,
        hostnames          = [_domain] @ _domains_extra,
        dns_internal       = [],
        dns_zone           = _dns_zone,
        acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
        acme_email         = _acme_email,
        cert_secret_ref    = "",
        cert_provider      = 'cloudflare,
        backup_backlog_ref = _backup_ref,
      }) & {
        backup | force = {
          kind        = 'pending,
          reason      = "BackupPolicy required — Forgejo /data PVC + PostgreSQL DB must be backed up as a group",
          backlog_ref = _backup_ref,
        },
        manifest_hooks = {
          init   = { pre = [
            { action = 'create-cf-secret },
            { file = "clusterissuer",  action = 'apply, skip_if_exists = true },
            { file = "certificate",    action = 'apply, skip_if_exists = true },
            { file = "referencegrant", action = 'apply },
            { action = 'patch-gateway-https },
          ] },
          update = { pre = [
            { file = "certificate",    action = 'apply, skip_if_exists = true },
            { file = "referencegrant", action = 'apply },
            { action = 'patch-gateway-https },
          ] },
          delete = { pre = [
            { action = 'remove-gateway-https },
            { file = "referencegrant", action = 'delete },
          ] },
        },
      },
  },
}