config

type CiliumConfig struct {
	Enabled bool   `yaml:"enabled"`
	Version string `yaml:"version,omitempty"` // informational; helm pin lives in GitOps
}

type ClusterConfig struct {
	Name         string             `yaml:"name"`
	K3sVersion   string             `yaml:"k3sVersion"`
	Kubeconfig   string             `yaml:"kubeconfig"`
	MetalLB      MetalLBConfig      `yaml:"metallb"`
	LoadBalancer LoadBalancerConfig `yaml:"loadBalancer"`
	Cilium       CiliumConfig       `yaml:"cilium"`
	Tailscale    TailscaleConfig    `yaml:"tailscale"`
	Docker       DockerConfig       `yaml:"docker"`
	Mounts       []MountConfig      `yaml:"mounts"`
	USB          USBConfig          `yaml:"usb"`
}

type Config struct {
	Cluster ClusterConfig `yaml:"cluster"`
	Nodes   []NodeConfig  `yaml:"nodes"`
}

type DockerConfig struct {
	Enabled bool `yaml:"enabled"`
	// DockerVersion and ContainerdVersion pin the node container runtime to an
	// exact, mutually-compatible apt version pair (held via apt-mark) so a node
	// restart or unattended upgrade can never pair a mismatched
	// containerd<->shim — the cause of the "unsupported protocol" pod-sandbox
	// creation failures. Empty falls back to lima.DefaultDockerVersion /
	// lima.DefaultContainerdVersion (the pin tracked in git, since cluster.yaml
	// is local). Bump the two together.
	DockerVersion     string `yaml:"dockerVersion,omitempty"`
	ContainerdVersion string `yaml:"containerdVersion,omitempty"`
}

type LoadBalancerConfig struct {
	// IPRange is the LoadBalancer VIP range (any MetalLB-style form: CIDR, dashed
	// range, bare-suffix range, or single IP). Used both to configure the chosen
	// LB backend and to derive the /24 tailnet subnet route for the VIPs.
	IPRange string `yaml:"ipRange"`
	// L2Hostnames are the stable nodes that advertise the LB range over the
	// tailnet (and, for MetalLB, pin the L2Advertisement). Empty = no pinning.
	L2Hostnames []string `yaml:"l2Hostnames"`
}

type MetalLBConfig struct {
	Enabled bool   `yaml:"enabled"`
	IPRange string `yaml:"ipRange"`
	// L2Hostnames pins the L2Advertisement to a stable subset of nodes via a
	// per-hostname nodeSelector (kubernetes.io/hostname). Empty = advertise from
	// all nodes (default MetalLB behaviour). Pinning stops the speaker VIP from
	// flapping onto high-latency Mac nodes.
	//
	// Legacy: prefer the backend-neutral cluster.loadBalancer.{ipRange,l2Hostnames}.
	// IPRange and L2Hostnames here remain a supported fallback (see
	// ClusterConfig.LBIPRange / LBL2Hostnames) so existing configs keep working.
	// (Not marked `Deprecated:` on purpose — the resolvers and their tests still
	// read these fields intentionally.)
	L2Hostnames []string `yaml:"l2Hostnames"`
}

type MountConfig struct {
	Location   string `yaml:"location"`             // host path; "~" is allowed and expanded on the target host
	MountPoint string `yaml:"mountPoint,omitempty"` // guest path; defaults to the same path as Location
	Writable   bool   `yaml:"writable,omitempty"`   // default false; the injected home-default sets this true
}

type NodeConfig struct {
	Host       string   `yaml:"host"`
	Role       string   `yaml:"role"`              // "server" or "agent"
	Pool       string   `yaml:"pool"`              //
	Kind       string   `yaml:"kind,omitempty"`    // "lima" (default, macOS+VM) | "native" (Linux host, no VM)
	NodeIP     string   `yaml:"nodeIP,omitempty"`  // native: override the auto-detected tailscale IP
	DataDir    string   `yaml:"dataDir,omitempty"` // native: relocate k3s data-dir + kubelet root-dir onto this path (e.g. a large /home when / is small); empty = k3s default /var/lib/rancher/k3s
	VM         VMConfig `yaml:"vm"`                // required for kind=lima; ignored for kind=native
	VMName     string   `yaml:"vmName,omitempty"`
	SSHUser    string   `yaml:"sshUser,omitempty"`
	SSHPort    string   `yaml:"sshPort,omitempty"`
	SSHKeyPath string   `yaml:"sshKeyPath,omitempty"`
}

type TailscaleConfig struct {
	Enabled bool   `yaml:"enabled"`
	AuthKey string `yaml:"authKey"`
}

type USBConfig struct {
	Renderers        []string   `yaml:"renderers,omitempty"`        // subset of fcos|baked; empty = all
	NodeNamePrefix   string     `yaml:"nodeNamePrefix,omitempty"`   // default "usb"
	Pool             string     `yaml:"pool,omitempty"`             // node pool label; default "usb"
	AgentToken       string     `yaml:"agentToken,omitempty"`       // dedicated least-privilege k3s agent token
	TailnetServerURL string     `yaml:"tailnetServerURL,omitempty"` // explicit tailnet API URL override
	Scratch          string     `yaml:"scratch,omitempty"`          // none|existing:<src>|free-space
	NodeTTL          string     `yaml:"nodeTTL,omitempty"`          // e.g. "30m"; prune NotReady ephemeral nodes older than this
	WiFi             WiFiConfig `yaml:"wifi,omitempty"`             // optional Wi-Fi creds baked into the boot config
}

type VMConfig struct {
	CPUs   int    `yaml:"cpus"`
	Memory string `yaml:"memory"`
	Disk   string `yaml:"disk"`
}

type WiFiConfig struct {
	SSID string `yaml:"ssid,omitempty"`
	PSK  string `yaml:"psk,omitempty"`
}