let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  private_gateway | default = {
    name        | default = "private-gateway",
    namespace   | default = "kube-system",
    gateway_ip  | default = "10.200.2.254",
    cidr        | default = "10.200.2.0/24",
    port        | default = 80,

    # HTTPS listeners owned declaratively by the gateway. Empty by default; a
    # workspace instance lists one entry per consumer service (matching its
    # HTTPRoute sectionName + cert secret) so a gateway apply no longer wipes them.
    https_listeners | default = [],

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — Cilium private gateway; infrastructure_glue with custom tls/dns reasons.
    concerns | default = _presets.infrastructure_glue & {
      tls | force = { kind = 'disabled, reason = "Gateway-API TLS handled by HTTPRoute consumers, not the gateway itself" },
      dns | force = { kind = 'disabled, reason = "no DNS records owned by this component (consumers declare their own)" },
    },
  },
}