let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  zot | default = {
    name          | default = "zot",
    version       | default = "v2.1.18",
    image         | default = "ghcr.io/project-zot/zot-linux-arm64:v2.1.18",
    namespace     | default = "data",
    port          | default = 5000,
    data_dir      | default = "/var/lib/data/zot",
    storage_class | default = "nfs-shared",
    mode          | default = 'cluster,

    requires | default = {
      storage     = { size = "50Gi", persistent = true },
      ports       = [{ port = 5000, exposure = 'private }],
      credentials = [],
    },

    provides | default = {
      service = "zot",
      port    = 5000,
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      health  = true,
    },
    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — public OCI registry; tls_endpoint_with_acme preset.
    concerns | default = (_presets.tls_endpoint_with_acme {
      tls_secret         = "zot-tls",
      cluster_issuer     = "letsencrypt-prod",
      hostnames          = [],
      dns_internal       = [],
      dns_zone           = "",
      acme_server        = "https://acme-v02.api.letsencrypt.org/directory",
      acme_email         = "",
      cert_secret_ref    = "",
      cert_provider      = 'cloudflare,
      backup_backlog_ref = "BACKUP-REGISTRY-001",
    }) & {
      backup | force = {
        kind        = 'pending,
        reason      = "BackupPolicy declared at workspace level (registry-stack BackupGroup)",
        backlog_ref = "BACKUP-REGISTRY-001",
      },
    },
  },
}