let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  GarageBucket = {
    name
      | String
      | doc "Bucket name created in Garage on install (idempotent)",

    key_name
      | String
      | doc "Garage API key name granted read-write on this bucket; access/secret key printed once on first creation",
  },

  Garage = {
    mode
      | std.enum.TagOrString
      | doc "Deployment mode — Garage is always a taskserv (StatefulSet)"
      | default = 'taskserv,

    version
      | String
      | doc "Garage release tag (git.deuxfleurs.fr/Deuxfleurs/garage releases)"
      | default = "v2.3.0",

    namespace
      | String
      | doc "K8s namespace for the Garage StatefulSet"
      | default = "garage",

    replicas
      | std.number.Nat
      | doc "StatefulSet replica count. 1 = single-node cluster (no inter-node replication)."
      | default = 1,

    replication_factor
      | std.number.Nat
      | doc "Garage data replication factor passed to the cluster layout. Must be <= replicas. 1 for single-node."
      | default = 1,

    storage_class_name
      | String
      | doc "StorageClass backing each Garage pod's data+meta PVC (e.g. hcloud-volumes for single-node attach, avoiding Longhorn replica placement on storage nodes)"
      | default = "hcloud-volumes",

    data_volume_size
      | String
      | doc "Per-pod PVC size for data_dir + metadata_dir"
      | default = "10Gi",

    s3_api_port
      | std.number.Nat
      | doc "Garage S3 API port"
      | default = 3900,

    admin_api_port
      | std.number.Nat
      | doc "Garage admin API port (bucket/key management)"
      | default = 3903,

    rpc_port
      | std.number.Nat
      | doc "Garage inter-node RPC port"
      | default = 3901,

    s3_region
      | String
      | doc "S3 region string Garage advertises; consumers must set this as their S3 client region"
      | default = "garage",

    secret_name
      | String
      | doc "Name of the K8s Secret in `namespace` holding GARAGE_RPC_SECRET and GARAGE_ADMIN_TOKEN — provisioned out-of-band (SOPS-managed), never generated by the install script"
      | default = "garage-rpc-admin",

    node_selector
      | {_ : String}
      | doc "nodeSelector for the Garage pod(s) — set at the infra layer, never baked into catalog defaults"
      | default = {},

    buckets
      | Array GarageBucket
      | doc "Buckets to create (idempotent) with their access keys on install"
      | default = [],

    operations
      | { install: Bool, reinstall: Bool, delete: Bool, health: Bool }
      | optional,

    live_check
      | { strategy: std.enum.TagOrString, scope: std.enum.TagOrString, namespace: String, selector: String }
      | optional,

    # ServiceConcerns umbrella (ADR-008).
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}