let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  odoo | default = {
    name             | default = "odoo",
    version          | default = "18.0",
    image            | default = "odoo:18.0",
    tenant           | default = "",
    namespace        | default = "",
    db_name          | default = "",
    db_host          | default = "postgresql.core-data.svc.cluster.local",
    db_port          | default = 5432,
    db_user          | default = "odoo",
    db_filter        | default = "",
    domain           | default = "",
    dns_zone         | default = "",
    cf_secret_name   | default = "",
    acme_email       | default = "",
    gateway_fip      | default = "",
    gateway_ip       | default = "",
    storage_class    | default = "longhorn-retain",
    cluster_issuer   | default = "letsencrypt-prod",
    gateway_name     | default = "libre-wuji",
    gateway_ns       | default = "kube-system",
    workers          | default = 0,
    max_cron_threads | default = 1,
    mode             | default = 'cluster,

    oca_addons | default = [
      "l10n-spain",
      "account-financial-reporting",
      "account-invoicing",
      "server-ux",
      "reporting-engine",
      "partner-contact",
      "account-payment",
      "bank-payment",
      "community-data-files",
    ],

    filestore_pvc          | default = "odoo-filestore",
    oca_addons_default_ref | default = "18.0",
    oca_addons_refs        | default = {},

    requires | default = {
      storage     = { size = "5Gi", persistent = true },
      ports       = [{ port = 8069, exposure = 'internal }],
      credentials = ["ODOO_DB_PASSWORD", "ODOO_ADMIN_PASSWORD"],
    },

    provides | default = {
      service   = "odoo",
      port      = 8069,
      endpoints = [],
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      backup  = true,
      restore = true,
      health  = true,
      restart = true,
    },

    pod_selector | default = "odoo",

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — Odoo ERP; tls_endpoint_with_acme preset.
    # Workspace overrides bring backup to 'enabled via odoo-stack BackupGroup.
    concerns | default = (_presets.tls_endpoint_with_acme {
      tls_secret         = "odoo-tls",
      cluster_issuer     = "letsencrypt-prod",
      hostnames          = [],
      dns_internal       = [],
      dns_zone           = "",
      acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
      acme_email         = "",
      cert_secret_ref    = "",
      cert_provider      = 'cloudflare,
      backup_backlog_ref = "BACKUP-ODOO-001",
    }) & {
      backup | force = {
        kind        = 'pending,
        reason      = "BackupPolicy declared at workspace level (odoo-stack BackupGroup with database scope + filestore service_full)",
        backlog_ref = "BACKUP-ODOO-001",
      },
      manifest_hooks = {
        init   = { pre = [
          { action = 'create-cf-secret },
          { file = "clusterissuer",  action = 'apply, skip_if_exists = true },
          { file = "certificate",    action = 'apply, skip_if_exists = true },
          { file = "referencegrant", action = 'apply },
          { action = 'patch-gateway-https },
        ] },
        update = { pre = [
          { file = "certificate",    action = 'apply, skip_if_exists = true },
          { file = "referencegrant", action = 'apply },
          { action = 'patch-gateway-https },
        ] },
        delete = { pre = [
          { action = 'remove-gateway-https },
          { file = "referencegrant", action = 'delete },
        ] },
      },
    },
  },
}