# Reusable ServiceExposure presets for component defaults.
#
# Component defaults.ncl files set `exposure | default = presets.<preset> {...}`
# to declare a full reachability surface without repeating the Binding plumbing.
# Each preset returns a complete ServiceExposure (service + namespace + exposures).
#
# Archetypes drawn from the `prvng net map` census:
#   - fip_l7_public   : public web app behind the shared-FIP Cilium Gateway
#                       (the 14 gateway_fip components: wordpress, odoo, cv, …)
#   - private_lb_l4   : VPN-reachable service on its own private LoadBalancer
#                       (grafana .4, prometheus .5 — direct L4, WireGuard-reachable)
#   - l4_host_router  : VPN-reachable via the Sozu private_ingress router
#                       (reg→zot, longhorn UI — consolidated behind .6)
#   - flat_wuwei      : cluster-internal only, no external entry

let _exp = import "exposure.ncl" in

{
  presets = {
    # ── Public web app on the shared FIP Cilium Gateway ──────────────────
    # surface='public: served on the public VLAN VIP that librecloud-fip-wuji
    # maps to. TLS terminates at the Gateway/Envoy.
    fip_l7_public = fun args =>
      {
        service   = args.service,
        namespace = args.namespace,
        exposures = [
          {
            hostnames = args.hostnames,
            surface   = 'public,
            binding   = { kind = 'gateway_l7_public, fip_name = args.fip_name },
            ports     = [{ name = "https", listen = 443, target = args.target_port, tls = 'gateway_terminate }],
          },
        ],
      },

    # ── VPN service on a dedicated private LoadBalancer ──────────────────
    # surface='vpn with an L4 LB DNAT: reachable from WireGuard (no Gateway
    # TPROXY in the path). entry_ip is the private LB VIP.
    private_lb_l4 = fun args =>
      {
        service   = args.service,
        namespace = args.namespace,
        exposures = [
          {
            hostnames = args.hostnames,
            surface   = 'vpn,
            binding   = { kind = 'l4_lb, entry_ip = args.entry_ip },
            ports     = [{ name = "https", listen = 443, target = args.target_port, tls = 'pod_terminate }],
          },
        ],
      },

    # ── VPN service behind the Sozu private_ingress host-router ──────────
    # surface='vpn, terminating at the private_ingress LB (.6). strict_chain
    # clients (lian-build pushing to reg) require Sozu to serve the full chain.
    l4_host_router = fun args =>
      let a = { strict_chain_clients | default = false } & args in
      {
        service   = a.service,
        namespace = a.namespace,
        exposures = [
          {
            hostnames = a.hostnames,
            surface   = 'vpn,
            binding   = { kind = 'l4_host_router, entry_ip = a.entry_ip },
            ports     = [{ name = "https", listen = 443, target = a.target_port, tls = 'pod_terminate }],
            strict_chain_clients = a.strict_chain_clients,
          },
        ],
      },

    # ── Cluster-internal only ────────────────────────────────────────────
    flat_wuwei = fun args =>
      let a = { hostnames | default = [], ports | default = [] } & args in
      {
        service   = a.service,
        namespace = a.namespace,
        exposures = [
          {
            hostnames = a.hostnames,
            surface   = 'cluster,
            binding   = { kind = 'cluster },
            ports     = a.ports,
          },
        ],
      },
  },
}