let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  StaticWeb = {
    context        | _context_lib.ComponentContext | optional,

    name           | String,
    namespace      | String,
    catalog_ref    | String | optional,

    # Full image reference without tag — defaults to public nginx
    image          | String | default = "nginx",
    image_tag      | String | default = "1.27-alpine",

    domain         | String,
    # Additional SANs included in cert and HTTPRoute hostnames
    domains_extra  | Array String | default = [],
    dns_zone       | String,
    acme_email     | String,
    cluster_issuer | String,

    # Gateway API sharing key for the public FIP gateway (e.g. librecloud-fip-wuji)
    gateway_fip    | String,
    # Gateway resource name and namespace — must match the Cilium Gateway in the cluster
    gateway_name   | String | default = "libre-wuji",
    gateway_ns     | String | default = "kube-system",

    # Longhorn storage class and PVC size — PVC is always provisioned
    storage_class  | String | default = "longhorn-retain",
    storage_size   | String | default = "2Gi",

    # Mount path for served static content inside the nginx container
    data_dir       | String | default = "/usr/share/nginx/html",

    http_port      | Number | default = 80,

    # Optional nginx config block injected at the end of the server{} block
    nginx_conf_extra | String | default = "",

    # Paths protected by HTTP basic auth.
    # Each entry creates a location block in nginx.conf and reads credentials
    # from SOPS key STATICWEB_HTPASSWD_{SLUG_UPPER} (htpasswd format).
    # Generate entries: htpasswd -n username → "username:$apr1$..."
    # Multiple users per path: newline-separated htpasswd lines.
    # slug must be unique within the component (used as filename and SOPS key).
    auth_paths | Array {
      path  | String,
      slug  | String,
      realm | String | default = "Restricted",
    } | default = [],

    requires | {
      storage     | { size | String, persistent | Bool } | optional,
      ports       | Array {
        port     | Number,
        exposure | [| 'public, 'private, 'internal |] | default = 'public,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = true,
      health  | Bool | default = true,
    } | default = {},

    live_check | {
      strategy | [| 'k8s_pods, 'http_get |] | default = 'k8s_pods,
      scope    | [| 'cp_only, 'all_nodes |] | default = 'cp_only,
    } | default = {},

    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}