v1alpha1

type ACMEConfig struct {
	// Email is the contact address registered with the ACME server.
	// Required.
	Email string `yaml:"email"`

	// Server is the ACME directory URL. Empty defers to the CRD
	// default (Let's Encrypt production).
	Server string `yaml:"server,omitempty"`
}

type AWSConfig struct {
	// AccountId is the 12-digit AWS account that owns the Route53 zone
	// and the IRSA IAM roles. Required.
	AccountId string `yaml:"accountId"`

	// Region is the AWS region. Required (Route53 hosted-zone API
	// calls and ACME-DNS01 challenges go through this region).
	Region string `yaml:"region"`

	// Route53HostedZoneId names the Route53 hosted zone for the
	// wildcard domain. Required.
	Route53HostedZoneId string `yaml:"route53HostedZoneId"`

	// CertManagerRoleARN is the IAM role assumed by the cert-manager
	// K8s ServiceAccount via IRSA. Empty defaults to
	// arn:aws:iam::<accountId>:role/educates-cert-manager.
	CertManagerRoleARN string `yaml:"certManagerRoleARN,omitempty"`

	// ExternalDNSRoleARN is the IAM role assumed by the external-dns
	// K8s ServiceAccount via IRSA. Empty defaults to
	// arn:aws:iam::<accountId>:role/educates-external-dns.
	ExternalDNSRoleARN string `yaml:"externalDNSRoleARN,omitempty"`
}

type ApiServerConfig struct {
	Address string `yaml:"address,omitempty"`
	Port    int    `yaml:"port,omitempty"`
}

type ClusterNode struct {
	Role   string             `yaml:"role"`
	Labels map[string]string  `yaml:"labels,omitempty"`
	Taints []ClusterNodeTaint `yaml:"taints,omitempty"`
}

type ClusterNodeTaint struct {
	Key    string `yaml:"key"`
	Value  string `yaml:"value,omitempty"`
	Effect string `yaml:"effect"`
}

type Config interface {
	GetAPIVersion() string
	GetKind() string
}

type EducatesConfig struct {
	TypeMeta `yaml:",inline"`

	// Target carries CLI-side-effect inputs (kind cluster bootstrap +
	// macOS resolver). Optional; when absent the CLI just applies the
	// declared CRs with no side effects. provider drives which side
	// effects run.
	Target *EducatesConfigTarget `yaml:"target,omitempty"`

	// Operator chart values surface — same fields as on every scenario kind.
	Operator LocalOperatorConfig `yaml:"operator,omitempty"`

	// CR-spec passthrough sections. Untyped on purpose: the JSON schema
	// (generated from the CRDs) is the source of truth for field shape.
	// Omitted LookupService means it is not deployed.
	EducatesClusterConfig map[string]interface{} `yaml:"educatesClusterConfig,omitempty"`
	SecretsManager        map[string]interface{} `yaml:"secretsManager,omitempty"`
	LookupService         map[string]interface{} `yaml:"lookupService,omitempty"`
	SessionManager        map[string]interface{} `yaml:"sessionManager,omitempty"`
}

type EducatesConfigTarget struct {
	Provider string              `yaml:"provider,omitempty"`
	Cluster  LocalClusterConfig  `yaml:"cluster,omitempty"`
	Resolver LocalResolverConfig `yaml:"resolver,omitempty"`
}

type EducatesEKSConfig struct {
	TypeMeta `yaml:",inline"`

	// AWS carries the account + Route53 + IAM role configuration.
	// accountId, region, and route53HostedZoneId are required; both IRSA
	// role ARNs default from accountId when empty.
	AWS AWSConfig `yaml:"aws"`

	// Domain is the wildcard ingress subdomain. Required.
	Domain string `yaml:"domain"`

	// ACME carries the cert-manager ACME config. Required: email.
	// (Shared shape with EducatesGKEConfig.)
	ACME ACMEConfig `yaml:"acme"`

	// ExternalTLSTermination asserts that TLS for the ingress domain is
	// terminated outside the cluster (cloud load balancer or proxy
	// forwarding plain HTTP inward). Generated portal and workshop URLs
	// use https regardless of in-cluster certificate presence. Maps to
	// SessionManager.spec.ingressOverrides.protocol: https.
	ExternalTLSTermination bool `yaml:"externalTLSTermination,omitempty"`

	// Top-level toggles shared with EducatesLocalConfig. Defaults:
	// clusterAdmin=false, lookupService=true, imagePrePuller=true.
	ClusterAdmin      *bool                        `yaml:"clusterAdmin,omitempty"`
	LookupService     *bool                        `yaml:"lookupService,omitempty"`
	ImagePrePuller    *bool                        `yaml:"imagePrePuller,omitempty"`
	WebsiteStyling    LocalWebsiteStylingConfig    `yaml:"websiteStyling,omitempty"`
	SecretPropagation LocalSecretPropagationConfig `yaml:"secretPropagation,omitempty"`
	ImageVersions     []ImageVersion               `yaml:"imageVersions,omitempty"`
	Operator          LocalOperatorConfig          `yaml:"operator,omitempty"`
}

type EducatesGKEConfig struct {
	TypeMeta `yaml:",inline"`

	// GCP carries the project + service-account configuration. project
	// is required; both WI service-account emails default from project
	// when empty.
	GCP GCPConfig `yaml:"gcp"`

	// Domain is the wildcard ingress subdomain. Required.
	Domain string `yaml:"domain"`

	// ACME carries the cert-manager ACME config. email is required;
	// server defaults to Let's Encrypt production at CRD level.
	ACME ACMEConfig `yaml:"acme"`

	// ExternalTLSTermination asserts that TLS for the ingress domain is
	// terminated outside the cluster (cloud load balancer or proxy
	// forwarding plain HTTP inward). Generated portal and workshop URLs
	// use https regardless of in-cluster certificate presence. Maps to
	// SessionManager.spec.ingressOverrides.protocol: https.
	ExternalTLSTermination bool `yaml:"externalTLSTermination,omitempty"`

	// Top-level toggles shared with EducatesLocalConfig. Defaults per
	// the locked design: clusterAdmin=false, lookupService=true,
	// imagePrePuller=true.
	ClusterAdmin      *bool                        `yaml:"clusterAdmin,omitempty"`
	LookupService     *bool                        `yaml:"lookupService,omitempty"`
	ImagePrePuller    *bool                        `yaml:"imagePrePuller,omitempty"`
	WebsiteStyling    LocalWebsiteStylingConfig    `yaml:"websiteStyling,omitempty"`
	SecretPropagation LocalSecretPropagationConfig `yaml:"secretPropagation,omitempty"`
	ImageVersions     []ImageVersion               `yaml:"imageVersions,omitempty"`
	Operator          LocalOperatorConfig          `yaml:"operator,omitempty"`
}

type EducatesInlineConfig struct {
	TypeMeta `yaml:",inline"`

	// Domain is the wildcard ingress subdomain. Required.
	Domain string `yaml:"domain"`

	// IngressClassName names the IngressClass routing to the BYO
	// controller (e.g. "contour", "openshift-default"). Required.
	IngressClassName string `yaml:"ingressClassName"`

	// WildcardCertificateSecret names a kubernetes.io/tls Secret in the
	// operator namespace with keys tls.crt + tls.key, valid for
	// *.<Domain>. Required unless externalTLSTermination is set, in which
	// case TLS lives outside the cluster and no in-cluster certificate is
	// referenced.
	WildcardCertificateSecret string `yaml:"wildcardCertificateSecret,omitempty"`

	// CACertificateSecret optionally names a Secret with the ca.crt
	// key for the CA chain that issued the wildcard. Workshops mount it
	// when they need to trust outbound calls to private endpoints.
	CACertificateSecret string `yaml:"caCertificateSecret,omitempty"`

	// ClusterIssuerName is informational — when a cert-manager
	// ClusterIssuer signed the wildcard, this name surfaces in status.
	// Optional.
	ClusterIssuerName string `yaml:"clusterIssuerName,omitempty"`

	// ImageRegistry optionally rewrites workshop image refs to live
	// behind an in-cluster mirror and supplies pull credentials.
	ImageRegistry InlineImageRegistry `yaml:"imageRegistry,omitempty"`

	// PolicyEnforcement names the engines the cluster already enforces.
	// Defaults: clusterEngine=Kyverno, workshopEngine=Kyverno.
	PolicyEnforcement InlinePolicyEnforcement `yaml:"policyEnforcement,omitempty"`

	// ExternalTLSTermination asserts that TLS for the ingress domain is
	// terminated outside the cluster (corporate load balancer or proxy
	// forwarding plain HTTP inward). No in-cluster wildcard certificate
	// is referenced, and generated portal and workshop URLs use https.
	// Maps to EducatesClusterConfig.spec.inline.ingress.protocol: https
	// with no wildcardCertificateSecretRef.
	ExternalTLSTermination bool `yaml:"externalTLSTermination,omitempty"`

	// Top-level toggles shared with EducatesLocalConfig.
	ClusterAdmin      *bool                        `yaml:"clusterAdmin,omitempty"`
	LookupService     *bool                        `yaml:"lookupService,omitempty"`
	ImagePrePuller    *bool                        `yaml:"imagePrePuller,omitempty"`
	WebsiteStyling    LocalWebsiteStylingConfig    `yaml:"websiteStyling,omitempty"`
	SecretPropagation LocalSecretPropagationConfig `yaml:"secretPropagation,omitempty"`
	ImageVersions     []ImageVersion               `yaml:"imageVersions,omitempty"`
	Operator          LocalOperatorConfig          `yaml:"operator,omitempty"`
}

type EducatesLocalConfig struct {
	TypeMeta `yaml:",inline"`

	Cluster           LocalClusterConfig           `yaml:"cluster,omitempty"`
	Resolver          LocalResolverConfig          `yaml:"resolver,omitempty"`
	Ingress           LocalIngressConfig           `yaml:"ingress,omitempty"`
	ClusterAdmin      *bool                        `yaml:"clusterAdmin,omitempty"`
	LookupService     *bool                        `yaml:"lookupService,omitempty"`
	ImagePrePuller    *bool                        `yaml:"imagePrePuller,omitempty"`
	WebsiteStyling    LocalWebsiteStylingConfig    `yaml:"websiteStyling,omitempty"`
	SecretPropagation LocalSecretPropagationConfig `yaml:"secretPropagation,omitempty"`
	ImageVersions     []ImageVersion               `yaml:"imageVersions,omitempty"`
	Operator          LocalOperatorConfig          `yaml:"operator,omitempty"`
}

type GCPConfig struct {
	// Project is the GCP project that owns the CloudDNS zone and the
	// Workload Identity service accounts. Required.
	Project string `yaml:"project"`

	// CertManagerServiceAccount is the GCP service-account email bound
	// to the cert-manager K8s ServiceAccount via Workload Identity.
	// Empty defaults to cert-manager@<project>.iam.gserviceaccount.com.
	CertManagerServiceAccount string `yaml:"certManagerServiceAccount,omitempty"`

	// ExternalDNSServiceAccount is the GCP service-account email bound
	// to the external-dns K8s ServiceAccount via Workload Identity.
	// Empty defaults to external-dns@<project>.iam.gserviceaccount.com.
	ExternalDNSServiceAccount string `yaml:"externalDNSServiceAccount,omitempty"`
}

type ImageVersion struct {
	Name  string `yaml:"name"`
	Image string `yaml:"image"`
}

type InlineImageRegistry struct {
	Prefix      string   `yaml:"prefix,omitempty"`
	PullSecrets []string `yaml:"pullSecrets,omitempty"`
}

type InlinePolicyEnforcement struct {
	// ClusterEngine enum: Kyverno | PodSecurityStandards | OpenShiftSCC | None.
	ClusterEngine string `yaml:"clusterEngine,omitempty"`
	// WorkshopEngine enum: Kyverno | None.
	WorkshopEngine string `yaml:"workshopEngine,omitempty"`
}

type LocalClusterConfig struct {
	ListenAddress         string           `yaml:"listenAddress,omitempty"`
	RegistryListenAddress string           `yaml:"registryListenAddress,omitempty"`
	ApiServer             ApiServerConfig  `yaml:"apiServer,omitempty"`
	Networking            NetworkingConfig `yaml:"networking,omitempty"`
	VolumeMounts          []VolumeMount    `yaml:"volumeMounts,omitempty"`
	RegistryMirrors       []RegistryMirror `yaml:"registryMirrors,omitempty"`
	Nodes                 []ClusterNode    `yaml:"nodes,omitempty"`
}

type LocalIngressConfig struct {
	Domain string `yaml:"domain,omitempty"`

	// Insecure serves the local cluster over plain HTTP with no TLS. No
	// CA or certificate is needed, so the one-time `educates local
	// secrets add ca` step is skipped. Translates to the operator's
	// certificates.provider: None with ingress.protocol: http.
	Insecure bool `yaml:"insecure,omitempty"`
}

type LocalOperatorConfig struct {
	Image            OperatorImage `yaml:"image,omitempty"`
	ImagePullSecrets []string      `yaml:"imagePullSecrets,omitempty"`
	LogLevel         string        `yaml:"logLevel,omitempty"`
}

type LocalResolverConfig struct {
	TargetAddress string   `yaml:"targetAddress,omitempty"`
	ExtraDomains  []string `yaml:"extraDomains,omitempty"`
}

type LocalSecretPropagationConfig struct {
	ImagePullSecretNames []string `yaml:"imagePullSecretNames,omitempty"`
}

type LocalWebsiteStylingConfig struct {
	DefaultTheme  string         `yaml:"defaultTheme,omitempty"`
	ThemeDataRefs []ThemeDataRef `yaml:"themeDataRefs,omitempty"`
}

type NetworkingConfig struct {
	ServiceSubnet string `yaml:"serviceSubnet,omitempty"`
	PodSubnet     string `yaml:"podSubnet,omitempty"`
}

type OperatorImage struct {
	Repository string `yaml:"repository,omitempty"`
	Tag        string `yaml:"tag,omitempty"`
	// PullPolicy maps to the chart's image.pullPolicy. Empty lets the
	// chart auto-derive it (Always for floating tags like develop,
	// IfNotPresent otherwise). Set to "Always" for local-registry
	// development where the tag (e.g. :dev) is rebuilt under the same
	// name on each push.
	PullPolicy string `yaml:"pullPolicy,omitempty"`
}

type RegistryMirror struct {
	Mirror   string `yaml:"mirror"`
	URL      string `yaml:"url,omitempty"`
	Username string `yaml:"username,omitempty"`
	Password string `yaml:"password,omitempty"`
	Port     string `yaml:"port,omitempty"`
	BindIP   string `yaml:"bindIP,omitempty"`
}

type ThemeDataRef struct {
	Namespace string `yaml:"namespace"`
	Name      string `yaml:"name"`
}

type TypeMeta struct {
	APIVersion string `yaml:"apiVersion" json:"apiVersion"`
	Kind       string `yaml:"kind"       json:"kind"`
}

type VolumeMount struct {
	HostPath      string `yaml:"hostPath"`
	ContainerPath string `yaml:"containerPath"`
	ReadOnly      *bool  `yaml:"readOnly,omitempty"`
}