v1alpha1

type BackendDatabaseSpec struct {
	// Engine selects the database type. Use "sqlite" for local development (requires persistence via PVC if not ephemeral) or "postgres"/"mysql" for production.
	// +kubebuilder:validation:Enum=postgres;mysql;sqlite
	Engine string `json:"engine"`

	// SecretRef names the Secret holding the DB connection URL.
	// Required for "postgres" and "mysql" engines.
	// +optional
	SecretRef string `json:"secretRef,omitempty"`

	// URLKey is the key inside the Secret containing the DB URL (e.g., "postgresql://user:pass@host/db").
	// Required for "postgres" and "mysql" engines.
	// +optional
	URLKey string `json:"urlKey,omitempty"`

	// DatabaseName overrides the default database name derived from the ConvexInstance name; used to populate INSTANCE_NAME.
	// Use this if your external database has a specific name requirement or if you are pointing multiple instances to different logical databases.
	// +optional
	DatabaseName string `json:"databaseName,omitempty"`

	// RequireSSL enforces TLS verification when connecting to the database. Defaults to true.
	// Set to false only if your database does not support TLS or uses self-signed certificates that cannot be verified (e.g., some local dev setups).
	// +kubebuilder:default:=true
	// +optional
	RequireSSL *bool `json:"requireSSL,omitempty"`
}

type BackendLoggingSpec struct {
	// RedactLogsToClient enables log redaction before sending logs to clients.
	// +kubebuilder:default:=false
	// +optional
	RedactLogsToClient bool `json:"redactLogsToClient,omitempty"`
}

type BackendPVCSpec struct {
	// +kubebuilder:default:=false
	Enabled bool `json:"enabled,omitempty"`

	// +optional
	StorageClassName string `json:"storageClassName,omitempty"`

	// Size is the requested capacity (e.g., "100Gi").
	// +optional
	Size resource.Quantity `json:"size,omitempty"`
}

type BackendS3Spec struct {
	// +kubebuilder:default:=false
	Enabled bool `json:"enabled,omitempty"`

	// SecretRef names the Secret containing S3 connection settings.
	// +optional
	SecretRef string `json:"secretRef,omitempty"`

	// ConfigMapRef names the ConfigMap containing S3 bucket metadata.
	// +optional
	ConfigMapRef string `json:"configMapRef,omitempty"`

	// AutoDetectOBC enables automatic discovery of ObjectBucketClaim companion resources.
	// +kubebuilder:default:=true
	// +optional
	AutoDetectOBC *bool `json:"autoDetectOBC,omitempty"`

	// Endpoint is the inline S3 endpoint URL (non-sensitive).
	// +optional
	Endpoint string `json:"endpoint,omitempty"`

	// EndpointKey is the key containing the S3 endpoint URL.
	// +optional
	EndpointKey string `json:"endpointKey,omitempty"`

	// EndpointHostKey is the key inside the ConfigMap containing the endpoint host.
	// +optional
	EndpointHostKey string `json:"endpointHostKey,omitempty"`

	// EndpointPortKey is the key inside the ConfigMap containing the endpoint port.
	// +optional
	EndpointPortKey string `json:"endpointPortKey,omitempty"`

	// EndpointScheme sets the URL scheme when constructing an endpoint from host/port.
	// +kubebuilder:validation:Enum=http;https
	// +kubebuilder:default:="http"
	// +optional
	EndpointScheme string `json:"endpointScheme,omitempty"`

	// +optional
	AccessKeyIDKey string `json:"accessKeyIdKey,omitempty"`

	// +optional
	SecretAccessKeyKey string `json:"secretAccessKeyKey,omitempty"`

	// Bucket is the inline bucket name (non-sensitive).
	// +optional
	Bucket string `json:"bucket,omitempty"`

	// BucketKey is the key containing the bucket name.
	// +optional
	BucketKey string `json:"bucketKey,omitempty"`

	// Region is the inline AWS region (non-sensitive).
	// +optional
	Region string `json:"region,omitempty"`

	// RegionKey is the key containing the AWS region.
	// +optional
	RegionKey string `json:"regionKey,omitempty"`

	// EmitS3EndpointUrl sets S3_ENDPOINT_URL alongside AWS endpoint env vars.
	// +optional
	EmitS3EndpointUrl bool `json:"emitS3EndpointUrl,omitempty"`
}

type BackendScaleSpec struct {
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=100
	// +optional
	CPUTargetUtilization *int32 `json:"cpuTargetUtilization,omitempty"`

	// MaxMemory sets an upper bound for memory allocations (e.g., "8Gi").
	// +optional
	MaxMemory resource.Quantity `json:"maxMemory,omitempty"`
}

type BackendSpec struct {
	// +kubebuilder:default:="ghcr.io/get-convex/convex-backend:latest"
	Image string `json:"image,omitempty"`

	// Resources configures requests/limits applied to the backend StatefulSet.
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// DB references the database connection secret and driver.
	DB BackendDatabaseSpec `json:"db"`

	// Storage configures local or external storage options.
	// +kubebuilder:default:={}
	Storage BackendStorageSpec `json:"storage,omitempty"`

	// S3 configures S3-compatible storage for blob usage.
	// +kubebuilder:default:={}
	S3 BackendS3Spec `json:"s3,omitempty"`

	// Telemetry configures optional beaconing.
	// +kubebuilder:default:={}
	Telemetry BackendTelemetrySpec `json:"telemetry,omitempty"`

	// Logging toggles log redaction.
	// +kubebuilder:default:={}
	Logging BackendLoggingSpec `json:"logging,omitempty"`

	// Security allows overriding pod/container security contexts for the backend StatefulSet.
	// +kubebuilder:default:={}
	Security SecuritySpec `json:"security,omitempty"`

	// Env appends additional environment variables to the backend container. Later entries override earlier ones.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`
}

type BackendStorageSpec struct {
	// Mode selects SQLite (local) or external storage wiring.
	// +kubebuilder:default:=sqlite
	// +kubebuilder:validation:Enum=sqlite;external
	Mode string `json:"mode,omitempty"`

	// PVC manages the persistent volume claim when using SQLite/local storage.
	// +optional
	PVC BackendPVCSpec `json:"pvc,omitempty"`
}

type BackendTelemetrySpec struct {
	// DisableBeacon opts out of the self-hosted usage beacon.
	// +kubebuilder:default:=false
	// +optional
	DisableBeacon bool `json:"disableBeacon,omitempty"`
}

type ConvexInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConvexInstanceSpec   `json:"spec"`
	Status ConvexInstanceStatus `json:"status,omitempty"`
}

type ConvexInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConvexInstance `json:"items"`
}

type ConvexInstanceSpec struct {
	// Environment describes the deployment tier.
	// +kubebuilder:validation:Enum=dev;prod
	Environment string `json:"environment"`

	// Version is the Convex release tag used by backend and dashboard images.
	// +kubebuilder:validation:MinLength=1
	Version string `json:"version"`

	// Backend configures the Convex backend process.
	Backend BackendSpec `json:"backend"`

	// Dashboard configures the optional Convex dashboard.
	// +kubebuilder:default:={}
	Dashboard DashboardSpec `json:"dashboard,omitempty"`

	// Networking configures ingress and TLS wiring.
	Networking NetworkingSpec `json:"networking"`

	// Scale captures resource scaling preferences.
	// +optional
	Scale ScaleSpec `json:"scale,omitempty"`

	// Maintenance configures upgrade handling.
	// +optional
	Maintenance MaintenanceSpec `json:"maintenance,omitempty"`
}

type ConvexInstanceStatus struct {
	// Phase is a coarse-grained lifecycle indicator.
	// +kubebuilder:validation:Enum=Pending;Ready;Error;Upgrading
	// +optional
	Phase string `json:"phase,omitempty"`

	// UpgradeHash tracks the last fully applied spec hash to gate future upgrades.
	// +optional
	UpgradeHash string `json:"upgradeHash,omitempty"`

	// ObservedGeneration reflects the last processed spec generation.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Endpoints captures external URLs.
	// +optional
	Endpoints InstanceEndpoints `json:"endpoints,omitempty"`

	// Conditions represent the current state of the ConvexInstance resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DashboardSpec struct {
	// +kubebuilder:default:=true
	Enabled bool `json:"enabled,omitempty"`

	// +kubebuilder:default:="ghcr.io/get-convex/convex-dashboard:latest"
	Image string `json:"image,omitempty"`

	// +kubebuilder:default:=1
	// +kubebuilder:validation:Minimum=1
	Replicas *int32 `json:"replicas,omitempty"`

	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// Security allows overriding pod/container security contexts for the dashboard Deployment.
	// +kubebuilder:default:={}
	Security SecuritySpec `json:"security,omitempty"`

	// PrefillAdminKey controls whether the dashboard receives NEXT_PUBLIC_ADMIN_KEY (default false to avoid exposing the key in the browser).
	// +optional
	PrefillAdminKey bool `json:"prefillAdminKey,omitempty"`
}

type InstanceEndpoints struct {
	// +optional
	APIURL string `json:"apiUrl,omitempty"`

	// +optional
	DashboardURL string `json:"dashboardUrl,omitempty"`
}

type MaintenanceSpec struct {
	// UpgradeStrategy controls how the backend is updated when the version or image changes.
	// "inPlace" (default) performs a rolling update of the StatefulSet.
	// "exportImport" runs a job to export data, updates the backend, and then imports the data; use this for major version upgrades that require data migration.
	// +kubebuilder:default:=inPlace
	// +kubebuilder:validation:Enum=inPlace;exportImport
	UpgradeStrategy string `json:"upgradeStrategy,omitempty"`

	// RestartInterval triggers a rolling restart after the specified duration to mitigate slow resource leaks. Set to "0s" to disable.
	// +kubebuilder:default:="168h"
	// +optional
	RestartInterval *metav1.Duration `json:"restartInterval,omitempty"`
}

type NetworkingSpec struct {
	// Host is the external hostname routed to backend/dashboard (e.g., "convex.example.com").
	// This host must resolve to the Ingress/Gateway IP.
	// +kubebuilder:validation:MinLength=1
	Host string `json:"host"`

	// DeploymentURL sets NEXT_PUBLIC_DEPLOYMENT_URL for the dashboard; defaults to the external host (scheme derived from TLS).
	// +optional
	DeploymentURL string `json:"deploymentUrl,omitempty"`

	// CloudOrigin sets CONVEX_CLOUD_ORIGIN; defaults to the external host (scheme derived from TLS).
	// +optional
	CloudOrigin string `json:"cloudOrigin,omitempty"`

	// SiteOrigin sets CONVEX_SITE_ORIGIN; defaults to the external host (scheme derived from TLS).
	// +optional
	SiteOrigin string `json:"siteOrigin,omitempty"`

	// ParentRefs overrides the operator-managed Gateway; when set, HTTPRoutes attach to these parent Gateways and the operator skips creating its own Gateway.
	// Use this to share a single Gateway across multiple ConvexInstances or to use a pre-provisioned Gateway.
	// +optional
	ParentRefs []ParentReference `json:"parentRefs,omitempty"`

	// GatewayClassName selects the GatewayClass for the generated Gateway.
	// +kubebuilder:default:=nginx
	// +optional
	GatewayClassName string `json:"gatewayClassName,omitempty"`

	// GatewayAnnotations are applied to the generated Gateway metadata.
	// +kubebuilder:default:={"cert-manager.io/cluster-issuer":"letsencrypt-prod-rfc2136"}
	// +optional
	GatewayAnnotations map[string]string `json:"gatewayAnnotations,omitempty"`

	// TLSSecretRef names the TLS secret used by Gateway/Ingress.
	// +optional
	TLSSecretRef string `json:"tlsSecretRef,omitempty"`
}

type ParentReference struct {
	// Name is the name of the parent Gateway.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace is the namespace of the parent Gateway. Defaults to the ConvexInstance namespace.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// SectionName targets a specific listener on the parent Gateway.
	// +optional
	SectionName string `json:"sectionName,omitempty"`
}

type ScaleSpec struct {
	// Backend defines CPU-based scaling preferences.
	// +optional
	Backend BackendScaleSpec `json:"backend,omitempty"`
}

type SecuritySpec struct {
	// Pod applies a pod-level security context to the workload.
	// +optional
	Pod *corev1.PodSecurityContext `json:"pod,omitempty"`

	// Container applies a container-level security context to the main container.
	// +optional
	Container *corev1.SecurityContext `json:"container,omitempty"`
}