let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  wireguard | default = {
    name         | default = "wireguard",
    version      | default = "15",
    image        | default = "ghcr.io/wg-easy/wg-easy:15",
    namespace    | default = "vpn",
    mode         | default = 'cluster,
    node         | default = "",
    fip_name     | default = "",
    lb_ipam_ip   | default = "",
    vpn_subnet   | default = "10.200.0.0/24",
    server_ip    | default = "10.200.0.1",
    wg_default_address | default = "10.200.0.x",
    listen_port  | default = 51820,
    ui_port      | default = 51821,
    dns          | default = ["1.1.1.1", "8.8.8.8"],
    mtu          | default = 1420,
    keepalive    | default = 25,
    host_network | default = false,

    client_allowed_ips | default = [
      "10.200.0.0/24",
    ],

    wg_post_up_extra   | default = [],
    wg_post_down_extra | default = [],

    requires | default = {
      storage       = { size = "1Gi", persistent = true },
      storage_class = "hcloud-volumes",
      ports = [
        { port = 51820, protocol = "UDP", exposure = 'public },
        { port = 51821, protocol = "TCP", exposure = 'internal },
      ],
      credentials = ["WGUI_PASSWORD", "PASSWORD_HASH", "WG_PRIVATE_KEY", "WG_PUBLIC_KEY"],
    },

    credential_generators | default = {
      WGUI_PASSWORD  = { kind = "random_password", length = 32 },
      PASSWORD_HASH  = { kind = "bcrypt_password", source = "WGUI_PASSWORD" },
      WG_PRIVATE_KEY = { kind = "wg_privkey" },
      WG_PUBLIC_KEY  = { kind = "wg_pubkey", source = "WG_PRIVATE_KEY" },
    },

    provides | default = {
      service = "wireguard",
      ports   = [51820],
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      restart = true,
      health  = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — WireGuard VPN gateway; stateless preset with custom tls/backup.
    concerns | default = _presets.stateless & {
      tls    | force = { kind = 'disabled, reason = "WireGuard uses its own Noise-protocol mTLS; no x509 termination" },
      backup | force = { kind = 'disabled, reason = "stateless: peer keys + config in git/SOPS; runtime state is connection metadata only" },
    },
  },
}