v1alpha1

type BackendDatabaseSpec struct {
	// +kubebuilder:validation:Enum=postgres;mysql;sqlite
	Engine string `json:"engine"`

	// SecretRef names the Secret holding the DB connection URL.
	// +optional
	SecretRef string `json:"secretRef,omitempty"`

	// URLKey is the key inside the Secret containing the DB URL.
	// +optional
	URLKey string `json:"urlKey,omitempty"`
}

type BackendPVCSpec struct {
	// +kubebuilder:default:=false
	Enabled bool `json:"enabled,omitempty"`

	// +optional
	StorageClassName string `json:"storageClassName,omitempty"`

	// Size is the requested capacity (e.g., "100Gi").
	// +optional
	Size resource.Quantity `json:"size,omitempty"`
}

type BackendS3Spec struct {
	// +kubebuilder:default:=false
	Enabled bool `json:"enabled,omitempty"`

	// SecretRef names the Secret containing S3 connection settings.
	// +optional
	SecretRef string `json:"secretRef,omitempty"`

	// +optional
	EndpointKey string `json:"endpointKey,omitempty"`

	// +optional
	AccessKeyIDKey string `json:"accessKeyIdKey,omitempty"`

	// +optional
	SecretAccessKeyKey string `json:"secretAccessKeyKey,omitempty"`

	// +optional
	BucketKey string `json:"bucketKey,omitempty"`
}

type BackendScaleSpec struct {
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=100
	// +optional
	CPUTargetUtilization *int32 `json:"cpuTargetUtilization,omitempty"`

	// MaxMemory sets an upper bound for memory allocations (e.g., "8Gi").
	// +optional
	MaxMemory resource.Quantity `json:"maxMemory,omitempty"`
}

type BackendSpec struct {
	// +kubebuilder:default:="ghcr.io/get-convex/convex-backend:latest"
	Image string `json:"image,omitempty"`

	// Resources configures requests/limits applied to the backend StatefulSet.
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// DB references the database connection secret and driver.
	DB BackendDatabaseSpec `json:"db"`

	// Storage configures local or external storage options.
	// +kubebuilder:default:={}
	Storage BackendStorageSpec `json:"storage,omitempty"`

	// S3 configures S3-compatible storage for blob usage.
	// +kubebuilder:default:={}
	S3 BackendS3Spec `json:"s3,omitempty"`

	// Security allows overriding pod/container security contexts for the backend StatefulSet.
	// +kubebuilder:default:={}
	Security SecuritySpec `json:"security,omitempty"`
}

type BackendStorageSpec struct {
	// Mode selects SQLite (local) or external storage wiring.
	// +kubebuilder:default:=sqlite
	// +kubebuilder:validation:Enum=sqlite;external
	Mode string `json:"mode,omitempty"`

	// PVC manages the persistent volume claim when using SQLite/local storage.
	// +optional
	PVC BackendPVCSpec `json:"pvc,omitempty"`
}

type ConvexInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConvexInstanceSpec   `json:"spec"`
	Status ConvexInstanceStatus `json:"status,omitempty"`
}

type ConvexInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConvexInstance `json:"items"`
}

type ConvexInstanceSpec struct {
	// Environment describes the deployment tier.
	// +kubebuilder:validation:Enum=dev;prod
	Environment string `json:"environment"`

	// Version is the Convex release tag used by backend and dashboard images.
	// +kubebuilder:validation:MinLength=1
	Version string `json:"version"`

	// Backend configures the Convex backend process.
	Backend BackendSpec `json:"backend"`

	// Dashboard configures the optional Convex dashboard.
	// +kubebuilder:default:={}
	Dashboard DashboardSpec `json:"dashboard,omitempty"`

	// Networking configures ingress and TLS wiring.
	Networking NetworkingSpec `json:"networking"`

	// Scale captures resource scaling preferences.
	// +optional
	Scale ScaleSpec `json:"scale,omitempty"`

	// Maintenance configures upgrade handling.
	// +optional
	Maintenance MaintenanceSpec `json:"maintenance,omitempty"`
}

type ConvexInstanceStatus struct {
	// Phase is a coarse-grained lifecycle indicator.
	// +kubebuilder:validation:Enum=Pending;Ready;Error;Upgrading
	// +optional
	Phase string `json:"phase,omitempty"`

	// UpgradeHash tracks the last fully applied spec hash to gate future upgrades.
	// +optional
	UpgradeHash string `json:"upgradeHash,omitempty"`

	// ObservedGeneration reflects the last processed spec generation.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Endpoints captures external URLs.
	// +optional
	Endpoints InstanceEndpoints `json:"endpoints,omitempty"`

	// Conditions represent the current state of the ConvexInstance resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DashboardSpec struct {
	// +kubebuilder:default:=true
	Enabled bool `json:"enabled,omitempty"`

	// +kubebuilder:default:="ghcr.io/get-convex/convex-dashboard:latest"
	Image string `json:"image,omitempty"`

	// +kubebuilder:default:=1
	// +kubebuilder:validation:Minimum=1
	Replicas *int32 `json:"replicas,omitempty"`

	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// Security allows overriding pod/container security contexts for the dashboard Deployment.
	// +kubebuilder:default:={}
	Security SecuritySpec `json:"security,omitempty"`
}

type InstanceEndpoints struct {
	// +optional
	APIURL string `json:"apiUrl,omitempty"`

	// +optional
	DashboardURL string `json:"dashboardUrl,omitempty"`
}

type MaintenanceSpec struct {
	// +kubebuilder:default:=inPlace
	// +kubebuilder:validation:Enum=inPlace;exportImport
	UpgradeStrategy string `json:"upgradeStrategy,omitempty"`
}

type NetworkingSpec struct {
	// Host is the external hostname routed to backend/dashboard.
	// +kubebuilder:validation:MinLength=1
	Host string `json:"host"`

	// GatewayClassName selects the GatewayClass for the generated Gateway.
	// +kubebuilder:default:=nginx
	// +optional
	GatewayClassName string `json:"gatewayClassName,omitempty"`

	// GatewayAnnotations are applied to the generated Gateway metadata.
	// +kubebuilder:default:={"cert-manager.io/cluster-issuer":"letsencrypt-prod-rfc2136"}
	// +optional
	GatewayAnnotations map[string]string `json:"gatewayAnnotations,omitempty"`

	// TLSSecretRef names the TLS secret used by Gateway/Ingress.
	// +optional
	TLSSecretRef string `json:"tlsSecretRef,omitempty"`
}

type ScaleSpec struct {
	// Backend defines CPU-based scaling preferences.
	// +optional
	Backend BackendScaleSpec `json:"backend,omitempty"`
}

type SecuritySpec struct {
	// Pod applies a pod-level security context to the workload.
	// +optional
	Pod *corev1.PodSecurityContext `json:"pod,omitempty"`

	// Container applies a container-level security context to the main container.
	// +optional
	Container *corev1.SecurityContext `json:"container,omitempty"`
}