let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  RevProxy = {
    context     | _context_lib.ComponentContext | optional,

    name        | String,
    namespace   | String | default = "rvprxy",
    catalog_ref | String | optional,

    image       | String | default = "sadoyan/aralez",
    image_tag   | String | default = "latest",

    # Dedicated Floating IP for the rev-proxy LoadBalancer Service
    fip_name    | String | default = "librecloud-fip-rvprxy",

    http_port   | Number | default = 6193,
    https_port  | Number | default = 6194,
    config_port | Number | default = 3000,

    storage_class | String | default = "longhorn-retain",
    storage_size  | String | default = "2Gi",
    # Shared content root; sites are served from {data_dir}/{domain}/
    data_dir      | String | default = "/opt/storage",

    acme_email  | String,

    # Each entry defines one served domain with its own cert-manager Certificate.
    # paths: per-path routing with optional auth. The default "/" path is always present.
    # auth.type: basic | apikey | jwt
    # auth.data for basic: "user:password" (plain — SOPS encrypts it at rest)
    # auth.data for apikey/jwt: the token/secret string
    # SOPS key naming: RVPRXY_AUTH_{DOMAIN_SLUG}_{PATH_SLUG}
    #   e.g. domain=somosloquecomemos.org path=/private/ →
    #        RVPRXY_AUTH_SOMOSLOQUECOMEMOS_ORG_PRIVATE
    sites | Array {
      domain         | String,
      dns_zone       | String,
      cluster_issuer | String,
      paths | Array {
        path    | String | default = "/",
        auth    | {
          type | [| 'basic, 'apikey, 'jwt |],
        } | optional,
      } | default = [{ path = "/" }],
    },

    requires | {
      storage     | { size | String, persistent | Bool } | optional,
      ports       | Array {
        port     | Number,
        exposure | [| 'public, 'private, 'internal |] | default = 'public,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = true,
      health  | Bool | default = true,
    } | default = {},

    live_check | {
      strategy | [| 'k8s_pods, 'http_get |] | default = 'k8s_pods,
      scope    | [| 'cp_only, 'all_nodes |] | default = 'cp_only,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}