let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  OntorefPanel = {
    name
      | String
      | doc "Kubernetes resource name — include the panel suffix to distinguish instances (e.g. ontoref-panel-mail)"
      | default = "ontoref-panel",

    namespace
      | String
      | doc "Namespace where this panel Deployment is created"
      | default = "ontoref-panel",

    image
      | String
      | doc "Full image reference — built by lamina/ontoref-panel with all connector features; published to reg.librecloud.online"
      | default = "reg.librecloud.online/lamina/ontoref-panel:latest",

    port
      | Number
      | doc "HTTP port the panel daemon listens on"
      | default = 8090,

    node
      | String
      | doc "Kubernetes node hostname to pin the Deployment to — required for connector-mail to share the RWO PVC on the same node"
      | default = "",

    panel_enabled
      | String
      | doc "Value for PANEL_ENABLED — the single panel name this deployment activates (mail | vpn | dns)",

    # ── Panel config ────────────────────────────────────────────────────────
    panel_ncl_path
      | String
      | doc "Workspace-relative path to panel.ncl — vars.nu reads it and embeds it in the ConfigMap at render time"
      | default = "config/panel.ncl",

    panel_token_secret
      | String
      | doc "Secret name holding PANEL_TOKEN credential — must be pre-created in the panel namespace"
      | default = "ontoref-panel-token",

    # ── connector-mail specific ─────────────────────────────────────────────
    mail_namespace
      | String
      | doc "Namespace of the docker-mailserver pod — used by RBAC and setup-proxy"
      | default = "mail",

    mail_pvc
      | String
      | doc "PVC name of the docker-mailserver data volume — mounted read-only for config file reads"
      | default = "docker-mailserver-mail-data",

    mail_data_subpath
      | String
      | doc "PVC subPath that contains postfix-accounts.cf, postfix-virtual.cf, etc."
      | default = "config",

    mail_pod_selector
      | String
      | doc "Label selector for the docker-mailserver pod targeted by the setup-proxy kubectl exec"
      | default = "app.kubernetes.io/name=docker-mailserver",

    mail_container
      | String
      | doc "Container name within the docker-mailserver pod to exec into"
      | default = "docker-mailserver",

    # ── connector-vpn specific ──────────────────────────────────────────────
    wg_easy_url
      | String
      | doc "Base URL of the wg-easy admin API — reachable from the cluster network (e.g. http://10.200.0.1:51821)"
      | default = "",

    wg_easy_secret
      | String
      | doc "Secret name holding WG_EASY_PASSWORD"
      | default = "wg-easy-password",

    # ── connector-dns specific ──────────────────────────────────────────────
    cloudflare_secret
      | String
      | doc "Secret name holding CLOUDFLARE_ZONE_ID and CLOUDFLARE_API_TOKEN"
      | default = "cloudflare-dns-credentials",

    # ── Private gateway ─────────────────────────────────────────────────────
    private_gateway_name
      | String
      | doc "Name of the Cilium Gateway serving private VPN-only routes"
      | default = "private-gateway",

    private_gateway_namespace
      | String
      | doc "Namespace of the private gateway Gateway resource"
      | default = "kube-system",

    private_gateway_hostname
      | String
      | doc "Hostname for the HTTPRoute — must resolve to the private gateway IP inside the VPN (e.g. panel-mail.in.librecloud.online)"
      | default = "",

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}