v1alpha1

type AccessTunnel struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Target       AccessTunnelTarget        `json:"target,omitempty"`
	ServiceToken *AccessTunnelServiceToken `json:"serviceToken,omitempty"`
	Status       AccessTunnelStatus        `json:"status,omitempty"`
}

type AccessTunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessTunnel `json:"items"`
}

type AccessTunnelServiceConfig struct {
	// Name of the new service to create
	// Defaults to the name of the Access object
	// +kubebuilder:validation:Optional
	Name string `json:"name,omitempty"`

	// Service port to expose with
	// Defaults to 8000
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=8000
	// +kubebuilder:validation:Minimum:=1
	// +kubebuilder:validation:Maximum:=65535
	Port int32 `json:"port,omitempty"`
}

type AccessTunnelServiceToken struct {
	// Access Service Token Secret
	// +kubebuilder:validation:Required
	SecretRef string `json:"secretRef,omitempty"`

	// Key in the secret to use for Access Service Token ID, defaults to CLOUDFLARE_ACCESS_SERVICE_TOKEN_ID
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_ACCESS_SERVICE_TOKEN_ID
	CLOUDFLARE_ACCESS_SERVICE_TOKEN_ID string `json:"CLOUDFLARE_ACCESS_SERVICE_TOKEN_ID,omitempty"`
	// Key in the secret to use for Access Service Token Token, defaults to CLOUDFLARE_ACCESS_SERVICE_TOKEN_TOKEN
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_ACCESS_SERVICE_TOKEN_TOKEN
	CLOUDFLARE_ACCESS_SERVICE_TOKEN_TOKEN string `json:"CLOUDFLARE_ACCESS_SERVICE_TOKEN_TOKEN,omitempty"`
}

type AccessTunnelStatus struct {
}

type AccessTunnelTarget struct {
	// cloudflared image to use
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="cloudflare/cloudflared:2025.4.0"
	Image string `json:"image,omitempty"`

	// Fqdn specifies the DNS name to access
	// This is not validated and used as provided
	// +kubebuilder:validation:Required
	Fqdn string `json:"fqdn,omitempty"`

	// Protocol to forward, better to use TCP?
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=tcp
	// +kubebuilder:validation:Enum:="tcp";"rdp";"smb";"ssh"
	Protocol string `json:"protocol,omitempty"`

	// Service Config
	// +kubebuilder:validation:Optional
	Svc AccessTunnelServiceConfig `json:"svc,omitempty"`
}

type CloudflareDetails struct {
	// +kubebuilder:validation:Required
	// Cloudflare Domain to which this tunnel belongs to
	Domain string `json:"domain,omitempty"`

	// +kubebuilder:validation:Required
	// Secret containing Cloudflare API key/token
	Secret string `json:"secret,omitempty"`

	// +kubebuilder:validation:Optional
	// Account Name in Cloudflare. AccountName and AccountId cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountName string `json:"accountName,omitempty"`

	// +kubebuilder:validation:Optional
	// Account ID in Cloudflare. AccountId and AccountName cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountId string `json:"accountId,omitempty"`

	// +kubebuilder:validation:Optional
	// Email to use along with API Key for Delete operations for new tunnels only, or as an alternate to API Token
	Email string `json:"email,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_KEY
	// Key in the secret to use for Cloudflare API Key, defaults to CLOUDFLARE_API_KEY. Needs Email also to be provided.
	// For Delete operations for new tunnels only, or as an alternate to API Token
	CLOUDFLARE_API_KEY string `json:"CLOUDFLARE_API_KEY,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_TOKEN
	// Key in the secret to use for Cloudflare API token, defaults to CLOUDFLARE_API_TOKEN
	CLOUDFLARE_API_TOKEN string `json:"CLOUDFLARE_API_TOKEN,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	// Key in the secret to use as credentials.json for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	CLOUDFLARE_TUNNEL_CREDENTIAL_FILE string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_FILE,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	// Key in the secret to use as tunnel secret for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET,omitempty"`
}

type ClusterTunnel struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TunnelSpec   `json:"spec,omitempty"`
	Status TunnelStatus `json:"status,omitempty"`
}

type ClusterTunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterTunnel `json:"items"`
}

type ExistingTunnel struct {
	// +kubebuilder:validation:Optional
	// Existing Tunnel ID to run on. Tunnel ID and Tunnel Name cannot be both empty. If both are provided, ID is used if valid, else falls back to Name.
	Id string `json:"id,omitempty"`

	// +kubebuilder:validation:Optional
	// Existing Tunnel name to run on. Tunnel Name and Tunnel ID cannot be both empty. If both are provided, ID is used if valid, else falls back to Name.
	Name string `json:"name,omitempty"`
}

type NewTunnel struct {
	// +kubebuilder:validation:Required
	// Tunnel name to create on Cloudflare.
	Name string `json:"name,omitempty"`
}

type ServiceInfo struct {
	// FQDN of the service
	Hostname string `json:"hostname"`
	// Target for cloudflared
	Target string `json:"target"`
}

type Tunnel struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TunnelSpec   `json:"spec,omitempty"`
	Status TunnelStatus `json:"status,omitempty"`
}

type TunnelBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TunnelBinding `json:"items"`
}

type TunnelBindingStatus struct {
	// To show on the kubectl cli
	Hostnames string        `json:"hostnames"`
	Services  []ServiceInfo `json:"services"`
}

type TunnelBindingSubject struct {
	// Kind can be Service
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="Service"
	Kind string `json:"kind"`
	// +kubebuilder:validation:Required
	Name string `json:"name"`
	// +kubebuilder:validation:Optional
	Spec TunnelBindingSubjectSpec `json:"spec"`
}

type TunnelBindingSubjectSpec struct {
	// Fqdn specifies the DNS name to access this service from.
	// Defaults to the service.metadata.name + tunnel.spec.domain.
	// If specifying this, make sure to use the same domain that the tunnel belongs to.
	// This is not validated and used as provided
	// +kubebuilder:validation:Optional
	Fqdn string `json:"fqdn,omitempty"`

	// Protocol specifies the protocol for the service. Should be one of http, https, tcp, udp, ssh or rdp.
	// Defaults to http, with the exceptions of https for 443, smb for 139 and 445, rdp for 3389 and ssh for 22 if the service has a TCP port.
	// The only available option for a UDP port is udp, which is default.
	// +kubebuilder:validation:Optional
	Protocol string `json:"protocol,omitempty"`

	// Path specifies a regular expression for to match on the request for http/https services
	// If a rule does not specify a path, all paths will be matched.
	// +kubebuilder:validation:Optional
	Path string `json:"path,omitempty"`

	// Target specified where the tunnel should proxy to.
	// Defaults to the form of <protocol>://<service.metadata.name>.<service.metadata.namespace>.svc:<port>
	// +kubebuilder:validation:Optional
	Target string `json:"target,omitempty"`

	// CaPool trusts the CA certificate referenced by the key in the secret specified in tunnel.spec.originCaPool.
	// tls.crt is trusted globally and does not need to be specified. Only useful if the protocol is HTTPS.
	// +kubebuilder:validation:Optional
	CaPool string `json:"caPool,omitempty"`

	// NoTlsVerify disables TLS verification for this service.
	// Only useful if the protocol is HTTPS.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	NoTlsVerify bool `json:"noTlsVerify"`

	// Http2Origin makes the service attempt to connect to origin using HTTP2.
	// Origin must be configured as https.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	Http2Origin bool `json:"http2Origin"`

	// ProxyAddress configures the listen address for that proxy
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="127.0.0.1"
	// +kubebuilder:validation:Pattern="((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$))"
	ProxyAddress string `json:"proxyAddress,omitempty"`

	// ProxyPort configures the listen port for that proxy
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=0
	// +kubebuilder:validation:Minimum:=0
	// +kubebuilder:validation:Maximum:=65535
	ProxyPort uint `json:"proxyPort,omitempty"`

	// ProxyType configures the proxy type.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=""
	// +kubebuilder:validation:Enum:="";"socks"
	ProxyType string `json:"proxyType,omitempty"`
}

type TunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Tunnel `json:"items"`
}

type TunnelRef struct {
	// Kind can be Tunnel or ClusterTunnel
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum:="ClusterTunnel";"Tunnel"
	Kind string `json:"kind"`
	// Name of the tunnel resource
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// +kubebuilder:validation:Optional
	// DisableDNSUpdates disables the DNS updates on Cloudflare, just managing the configs. Assumes the DNS entries are manually added.
	DisableDNSUpdates bool `json:"disableDNSUpdates"`
}

type TunnelSpec struct {
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:default:=1
	// +kubebuilder:validation:Optional
	// Size defines the number of Daemon pods to run for this tunnel
	Size int32 `json:"size,omitempty"`

	// +kubebuilder:default:="cloudflare/cloudflared:2025.4.0"
	// +kubebuilder:validation:Optional
	// Image sets the Cloudflared Image to use. Defaults to the image set during the release of the operator.
	Image string `json:"image,omitempty"`

	// +kubebuilder:default:=false
	// +kubebuilder:validation:Optional
	// NoTlsVerify disables origin TLS certificate checks when the endpoint is HTTPS.
	NoTlsVerify bool `json:"noTlsVerify,omitempty"`

	// +kubebuilder:validation:Optional
	// OriginCaPool speficies the secret with tls.crt (and other certs as needed to be referred in the service annotation) of the Root CA to be trusted when sending traffic to HTTPS endpoints
	OriginCaPool string `json:"originCaPool,omitempty"`

	// +kubebuilder:validation:Optional
	// NodeSelectors specifies the nodeSelectors to apply to the cloudflared tunnel deployment
	NodeSelectors map[string]string `json:"nodeSelectors,omitempty"`

	// +kubebuilder:validation:Optional
	// Tolerations specifies the tolerations to apply to the cloudflared tunnel deployment
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum={"auto","quic","http2"}
	// +kubebuilder:default:="auto"
	// Protocol specifies the protocol to use for the tunnel. Defaults to auto. Options are "auto", "quic" and "http2"
	Protocol string `json:"protocol,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:="http_status:404"
	// FallbackTarget speficies the target for requests that do not match an ingress. Defaults to http_status:404
	FallbackTarget string `json:"fallbackTarget,omitempty"`

	// +kubebuilder:validation:Required
	// Cloudflare Credentials
	Cloudflare CloudflareDetails `json:"cloudflare,omitempty"`

	// +kubebuilder:validation:Optional
	// Existing tunnel object.
	// ExistingTunnel and NewTunnel cannot be both empty and are mutually exclusive.
	ExistingTunnel ExistingTunnel `json:"existingTunnel,omitempty"`

	// +kubebuilder:validation:Optional
	// New tunnel object.
	// NewTunnel and ExistingTunnel cannot be both empty and are mutually exclusive.
	NewTunnel NewTunnel `json:"newTunnel,omitempty"`
}

type TunnelStatus struct {
	TunnelId   string `json:"tunnelId"`
	TunnelName string `json:"tunnelName"`
	AccountId  string `json:"accountId"`
	ZoneId     string `json:"zoneId"`
}

type V1alpha1Tov1alpha2Patch struct {
	Spec   *V1alpha1Tov1alpha2PatchSpec `json:"spec,omitempty"`
	Extras map[string]any               `json:",inline,omitempty"`
}

type V1alpha1Tov1alpha2PatchSpec struct {
	Replicas int32                                `json:"replicas,omitempty"`
	Template *V1alpha1Tov1alpha2PatchSpecTemplate `json:"template,omitempty"`
	Extras   map[string]any                       `json:",inline,omitempty"`
}

type V1alpha1Tov1alpha2PatchSpecTemplate struct {
	Spec   *V1alpha1Tov1alpha2PatchSpecTemplateSpec `json:"spec,omitempty"`
	Extras map[string]any                           `json:",inline,omitempty"`
}

type V1alpha1Tov1alpha2PatchSpecTemplateSpec struct {
	Tolerations  []corev1.Toleration                                `json:"tolerations,omitempty"`
	NodeSelector map[string]string                                  `json:"nodeSelector,omitempty"`
	Containers   []V1alpha1Tov1alpha2PatchSpecTemplateSpecContainer `json:"containers,omitempty"`
	Extras       map[string]any                                     `json:",inline,omitempty"`
}

type V1alpha1Tov1alpha2PatchSpecTemplateSpecContainer struct {
	Name   string         `json:"name,omitempty"`
	Image  string         `json:"image,omitempty"`
	Extras map[string]any `json:",inline,omitempty"`
}