let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  Longhorn = {
    version
      | String
      | doc "Longhorn manifest version — applied as: kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v<version>/deploy/longhorn.yaml"
      | default = "1.11.1",

    namespace
      | String
      | doc "Kubernetes namespace for all Longhorn system components"
      | default = "longhorn-system",

    # ── StorageClass ────────────────────────────────────────────────────────
    storage_class_name
      | String
      | doc "Name of the StorageClass created by Longhorn"
      | default = "longhorn",

    is_default_class
      | Bool
      | doc "Promote Longhorn StorageClass as cluster default — demotes demote_default_class if non-empty"
      | default = true,

    reclaim_policy
      | std.enum.TagOrString
      | doc "PersistentVolume reclaim policy: Retain keeps data on PVC delete, Delete removes it"
      | default = 'Retain,

    allow_volume_expansion
      | Bool
      | doc "Allow online volume resize via kubectl patch pvc"
      | default = true,

    demote_default_class
      | String
      | doc "StorageClass to strip of is-default annotation when is_default_class=true — empty = no demotion"
      | default = "hcloud-volumes",

    # ── Storage nodes ───────────────────────────────────────────────────────
    storage_nodes
      | Array String
      | doc "Hostnames of K8s nodes to label with node.longhorn.io/create-default-disk=true before install. Empty = rely on pre-labeled nodes."
      | default = [],

    # ── Replication & data ──────────────────────────────────────────────────
    replica_count
      | Number
      | doc "Default replica count for new volumes. Install aborts if fewer than this many labeled storage nodes are Ready. Bump to 3 when strg-2 is activated."
      | default = 2,

    default_data_path
      | String
      | doc "Host path Longhorn uses for volume data — must match vol_prepare mount_path on storage nodes"
      | default = "/var/lib/longhorn",

    # ── Network ─────────────────────────────────────────────────────────────
    storage_network_interface
      | String
      | doc "Host network interface pinned for replica sync traffic. Empty = Longhorn auto-selects using the K8s node IP (private IP on Hetzner). Set to interface name (e.g. enp7s0) for explicit binding."
      | default = "",

    # ── Node scheduling ─────────────────────────────────────────────────────
    node_selector
      | { _ | String }
      | doc "Label selector restricting Longhorn manager and driver pods to specific nodes — empty = all nodes"
      | default = {},

    taint_toleration
      | String
      | doc "Taint toleration for Longhorn components — empty = no toleration; format: 'key:effect'"
      | default = "",

    # ── UI ──────────────────────────────────────────────────────────────────
    ui_enabled
      | Bool
      | doc "Deploy Longhorn UI frontend deployment"
      | default = true,

    ui_ingress_enabled
      | Bool
      | doc "Create an Ingress for the Longhorn UI — requires ui_enabled=true and ui_ingress_host to be set"
      | default = false,

    ui_ingress_host
      | String
      | doc "Hostname for the Longhorn UI Ingress (e.g. longhorn.example.com) — required when ui_ingress_enabled=true"
      | default = "",

    ui_ingress_class
      | String
      | doc "Ingress class name — must match the cluster ingress controller (cilium for this infra)"
      | default = "cilium",

    ui_ingress_tls_secret
      | String
      | doc "TLS secret name in longhorn-system namespace — empty = no TLS on ingress"
      | default = "",

    ui_ingress_annotations
      | { _ | String }
      | doc "Extra annotations merged onto the Ingress resource (e.g. cert-manager, auth annotations)"
      | default = {},

    private_gateway_name
      | String
      | doc "Name of the Cilium Gateway exposing this service via the private VPN subnet — empty disables HTTPRoute creation"
      | default = "",

    private_gateway_namespace
      | String
      | doc "Namespace of the private gateway — must match the Gateway object's namespace"
      | default = "kube-system",

    private_gateway_hostname
      | String
      | doc "Hostname for the HTTPRoute virtualhost — required when multiple services share the same private gateway IP:port"
      | default = "",

    # ServiceConcerns umbrella (ADR-008). Longhorn is a storage backend; its
    # engine state is captured by SystemBackupDef.longhorn_engine, not by a
    # per-component BackupPolicy. Defaults to the infra_storage_managed preset.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}