v1alpha1

type BotManagementSettings struct {
	// EnableJS enables JavaScript detections.
	// +optional
	EnableJS *bool `json:"enableJS,omitempty"`

	// FightMode enables bot fight mode.
	// +optional
	FightMode *bool `json:"fightMode,omitempty"`
}

type CloudflareDNSRecord struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of CloudflareDNSRecord
	// +required
	Spec CloudflareDNSRecordSpec `json:"spec"`

	// status defines the observed state of CloudflareDNSRecord
	// +optional
	Status CloudflareDNSRecordStatus `json:"status,omitzero"`
}

type CloudflareDNSRecordList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareDNSRecord `json:"items"`
}

type CloudflareDNSRecordSpec struct {
	// ZoneID is the Cloudflare Zone ID.
	// Mutually exclusive with ZoneRef.
	// +optional
	// +kubebuilder:validation:MinLength=1
	ZoneID string `json:"zoneID,omitempty"`

	// ZoneRef references a CloudflareZone resource in the same namespace.
	// The controller resolves the zone ID from the referenced resource's status.
	// Mutually exclusive with ZoneID.
	// +optional
	ZoneRef *ZoneReference `json:"zoneRef,omitempty"`

	// Name is the DNS record name (e.g., "example.com", "sub.example.com").
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Type is the DNS record type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=A;AAAA;CNAME;SRV;MX;TXT;NS
	Type string `json:"type"`

	// Content is the record content (IP address, hostname, etc.).
	// Mutually exclusive with DynamicIP.
	// +optional
	Content *string `json:"content,omitempty"`

	// DynamicIP enables automatic external IP resolution for this record.
	// Only valid for type A. Mutually exclusive with Content.
	// +optional
	DynamicIP bool `json:"dynamicIP,omitempty"`

	// TTL is the time-to-live in seconds. Use 1 for automatic.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	// +optional
	TTL int `json:"ttl,omitempty"`

	// Proxied indicates whether the record is proxied through Cloudflare.
	// +optional
	Proxied *bool `json:"proxied,omitempty"`

	// SRVData contains SRV-specific record data.
	// Required when Type is SRV.
	// +optional
	SRVData *SRVData `json:"srvData,omitempty"`

	// Priority is the record priority (used for MX and SRV records).
	// +optional
	Priority *int `json:"priority,omitempty"`

	// SecretRef references a Secret containing Cloudflare API credentials.
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// Interval is the reconciliation interval for drift detection.
	// +kubebuilder:default="5m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`
}

type CloudflareDNSRecordStatus struct {
	// Conditions represent the latest available observations of the resource's state.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`

	// RecordID is the Cloudflare DNS record ID.
	// +optional
	RecordID string `json:"recordID,omitempty"`

	// CurrentContent is the current content/value of the DNS record in Cloudflare.
	// +optional
	CurrentContent string `json:"currentContent,omitempty"`

	// LastSyncedAt is the last time the record was successfully synced.
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// ObservedGeneration is the most recently observed generation of the CR.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type CloudflareRuleset struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of CloudflareRuleset
	// +required
	Spec CloudflareRulesetSpec `json:"spec"`

	// status defines the observed state of CloudflareRuleset
	// +optional
	Status CloudflareRulesetStatus `json:"status,omitzero"`
}

type CloudflareRulesetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareRuleset `json:"items"`
}

type CloudflareRulesetSpec struct {
	// ZoneID is the Cloudflare Zone ID.
	// Mutually exclusive with ZoneRef.
	// +optional
	// +kubebuilder:validation:MinLength=1
	ZoneID string `json:"zoneID,omitempty"`

	// ZoneRef references a CloudflareZone resource in the same namespace.
	// The controller resolves the zone ID from the referenced resource's status.
	// Mutually exclusive with ZoneID.
	// +optional
	ZoneRef *ZoneReference `json:"zoneRef,omitempty"`

	// Name is the human-readable name for the ruleset.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Description is an informative description of the ruleset.
	// +optional
	Description string `json:"description,omitempty"`

	// Phase is the phase of the ruleset.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=http_request_firewall_custom;http_request_firewall_managed;http_request_late_transform;http_request_redirect;http_request_transform;http_response_headers_transform;http_response_firewall_managed;http_config_settings;http_custom_errors;http_ratelimit;http_request_cache_settings;http_request_origin;http_request_dynamic_redirect;http_response_compression
	Phase string `json:"phase"`

	// Rules is the list of rules in the ruleset.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Rules []RulesetRuleSpec `json:"rules"`

	// SecretRef references a Secret containing Cloudflare API credentials.
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// Interval is the reconciliation interval.
	// +kubebuilder:default="30m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`
}

type CloudflareRulesetStatus struct {
	// Conditions represent the latest available observations of the resource's state.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// RulesetID is the Cloudflare Ruleset ID.
	// +optional
	RulesetID string `json:"rulesetID,omitempty"`

	// RuleCount is the number of rules in the ruleset.
	// +optional
	RuleCount int `json:"ruleCount,omitempty"`

	// LastSyncedAt is the last time the ruleset was successfully synced.
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// ObservedGeneration is the most recently observed generation of the CR.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`
}

type CloudflareTunnel struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of CloudflareTunnel
	// +required
	Spec CloudflareTunnelSpec `json:"spec"`

	// status defines the observed state of CloudflareTunnel
	// +optional
	Status CloudflareTunnelStatus `json:"status,omitzero"`
}

type CloudflareTunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareTunnel `json:"items"`
}

type CloudflareTunnelRule struct {
	metav1.TypeMeta `json:",inline"`

	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// +required
	Spec CloudflareTunnelRuleSpec `json:"spec"`

	// +optional
	Status CloudflareTunnelRuleStatus `json:"status,omitzero"`
}

type CloudflareTunnelRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareTunnelRule `json:"items"`
}

type CloudflareTunnelRuleSpec struct {
	// TunnelRef points at the CloudflareTunnel this rule attaches to.
	// +kubebuilder:validation:Required
	TunnelRef TunnelReference `json:"tunnelRef"`

	// Hostnames that cloudflared should route to the Backend. At least one
	// is required; order is preserved within the aggregated ingress list.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Hostnames []string `json:"hostnames"`

	// Backend describes where traffic for these hostnames flows.
	// +kubebuilder:validation:Required
	Backend TunnelRuleBackend `json:"backend"`

	// OriginRequest pass-through options.
	// +optional
	OriginRequest *TunnelRuleOriginRequest `json:"originRequest,omitempty"`

	// SourceRef identifies the source that produced this rule. Present on
	// operator-emitted rules; absent on hand-authored rules.
	// +optional
	SourceRef *TunnelRuleSourceRef `json:"sourceRef,omitempty"`

	// Priority determines evaluation order within the aggregated ingress list.
	// Higher values are evaluated first. Default 100; ties broken by
	// metadata.name ascending.
	// +kubebuilder:default=100
	// +optional
	Priority int `json:"priority"`
}

type CloudflareTunnelRuleStatus struct {
	// Conditions: Valid, TunnelAccepted, Conflict. Written by the
	// CloudflareTunnel controller during aggregation.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`

	// ResolvedBackend is the URL cloudflared was configured with for this
	// rule. Populated after the tunnel controller renders a config.
	// +optional
	ResolvedBackend string `json:"resolvedBackend,omitempty"`

	// AppliedToConfigHash records the tunnel's config-hash at the last time
	// this rule was included. Useful for debugging drift.
	// +optional
	AppliedToConfigHash string `json:"appliedToConfigHash,omitempty"`

	// ObservedGeneration is the most recently observed generation.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type CloudflareTunnelSpec struct {
	// Name is the tunnel name in Cloudflare.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// SecretRef references a Secret containing Cloudflare API credentials.
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// GeneratedSecretName is the name of the Secret to create with tunnel
	// credentials.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	GeneratedSecretName string `json:"generatedSecretName"`

	// Interval is the reconciliation interval.
	// +kubebuilder:default="30m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`

	// Connector configures an operator-managed cloudflared workload for this
	// tunnel. When disabled (default), users run cloudflared themselves.
	// +optional
	Connector *ConnectorSpec `json:"connector,omitempty"`

	// Routing configures tunnel-wide defaults for cloudflared ingress:
	// the default backend (for traffic no CloudflareTunnelRule matches) and
	// originRequest defaults applied to all rules.
	// +optional
	Routing *TunnelRoutingSpec `json:"routing,omitempty"`
}

type CloudflareTunnelStatus struct {
	// Conditions: Ready, ConnectorReady, IngressConfigured.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`

	// TunnelID is the Cloudflare Tunnel ID.
	// +optional
	TunnelID string `json:"tunnelID,omitempty"`

	// TunnelCNAME is the CNAME for the tunnel (tunnelID.cfargotunnel.com).
	// +optional
	TunnelCNAME string `json:"tunnelCNAME,omitempty"`

	// CredentialsSecretName is the name of the generated credentials Secret.
	// +optional
	CredentialsSecretName string `json:"credentialsSecretName,omitempty"`

	// Connector reflects the state of the operator-managed cloudflared
	// Deployment (when spec.connector.enabled=true).
	// +optional
	Connector *ConnectorStatus `json:"connector,omitempty"`

	// LastSyncedAt is the last time the tunnel was successfully synced.
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// ObservedGeneration is the most recently observed generation.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type CloudflareZone struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of CloudflareZone
	// +required
	Spec CloudflareZoneSpec `json:"spec"`

	// status defines the observed state of CloudflareZone
	// +optional
	Status CloudflareZoneStatus `json:"status,omitzero"`
}

type CloudflareZoneConfig struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of CloudflareZoneConfig
	// +required
	Spec CloudflareZoneConfigSpec `json:"spec"`

	// status defines the observed state of CloudflareZoneConfig
	// +optional
	Status CloudflareZoneConfigStatus `json:"status,omitzero"`
}

type CloudflareZoneConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareZoneConfig `json:"items"`
}

type CloudflareZoneConfigSpec struct {
	// ZoneID is the Cloudflare Zone ID.
	// Mutually exclusive with ZoneRef.
	// +optional
	// +kubebuilder:validation:MinLength=1
	ZoneID string `json:"zoneID,omitempty"`

	// ZoneRef references a CloudflareZone resource in the same namespace.
	// The controller resolves the zone ID from the referenced resource's status.
	// Mutually exclusive with ZoneID.
	// +optional
	ZoneRef *ZoneReference `json:"zoneRef,omitempty"`

	// SecretRef references a Secret containing Cloudflare API credentials.
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// Interval is the reconciliation interval.
	// +kubebuilder:default="30m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`

	// SSL defines SSL/TLS settings for the zone.
	// +optional
	SSL *SSLSettings `json:"ssl,omitempty"`

	// Security defines security settings for the zone.
	// +optional
	Security *SecuritySettings `json:"security,omitempty"`

	// Performance defines performance settings for the zone.
	// +optional
	Performance *PerformanceSettings `json:"performance,omitempty"`

	// Network defines network settings for the zone.
	// +optional
	Network *NetworkSettings `json:"network,omitempty"`

	// DNS defines DNS-related settings for the zone.
	// +optional
	DNS *DNSSettings `json:"dns,omitempty"`

	// BotManagement defines bot management settings for the zone.
	// +optional
	BotManagement *BotManagementSettings `json:"botManagement,omitempty"`
}

type CloudflareZoneConfigStatus struct {
	// Conditions represent the latest available observations of the resource's state.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`

	// ZoneID is the resolved Cloudflare Zone ID, populated regardless of
	// whether the spec used zoneID or zoneRef.
	// +optional
	ZoneID string `json:"zoneID,omitempty"`

	// AppliedSpecHash is a hash of the settings-relevant spec fields the last
	// time reconciliation successfully applied them. When the current hash
	// matches, the controller skips the per-setting API calls.
	// +optional
	AppliedSpecHash string `json:"appliedSpecHash,omitempty"`

	// LastSyncedAt is the last time the zone config was successfully synced.
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// ObservedGeneration is the most recently observed generation of the CR.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type CloudflareZoneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []CloudflareZone `json:"items"`
}

type CloudflareZoneSpec struct {
	// Name is the domain name to onboard (e.g., "example.com").
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Type is the zone type. "full" means Cloudflare is the authoritative DNS.
	// "partial" is a CNAME setup. Immutable after creation.
	// +kubebuilder:validation:Enum=full;partial;secondary
	// +kubebuilder:default="full"
	// +optional
	Type string `json:"type,omitempty"`

	// Paused indicates whether the zone is paused (not serving traffic through Cloudflare).
	// +optional
	Paused *bool `json:"paused,omitempty"`

	// DeletionPolicy controls what happens when the CR is deleted.
	// "Retain" (default) leaves the zone in Cloudflare.
	// "Delete" removes the zone from Cloudflare.
	// +kubebuilder:validation:Enum=Retain;Delete
	// +kubebuilder:default="Retain"
	// +optional
	DeletionPolicy string `json:"deletionPolicy,omitempty"`

	// SecretRef references a Secret containing Cloudflare API credentials.
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// Interval is the reconciliation interval.
	// +kubebuilder:default="30m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`
}

type CloudflareZoneStatus struct {
	// Conditions represent the latest available observations.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ZoneID is the Cloudflare Zone ID.
	// +optional
	ZoneID string `json:"zoneID,omitempty"`

	// Status is the zone status in Cloudflare (initializing, pending, active, moved).
	// +optional
	Status string `json:"status,omitempty"`

	// NameServers are the Cloudflare-assigned nameservers for this zone.
	// Update your registrar's NS records to these values to activate the zone.
	// +optional
	NameServers []string `json:"nameServers,omitempty"`

	// OriginalNameServers are the nameservers before migration to Cloudflare.
	// +optional
	OriginalNameServers []string `json:"originalNameServers,omitempty"`

	// OriginalRegistrar is the registrar at the time of onboarding.
	// +optional
	OriginalRegistrar string `json:"originalRegistrar,omitempty"`

	// ActivatedOn is the time the zone became active.
	// +optional
	ActivatedOn *metav1.Time `json:"activatedOn,omitempty"`

	// LastSyncedAt is the last time the zone was successfully synced.
	// +optional
	LastSyncedAt *metav1.Time `json:"lastSyncedAt,omitempty"`

	// ObservedGeneration is the most recently observed generation.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Phase is a coarse summary of the reconciliation state. See
	// cloudflarev1alpha1.Phase for the enum values.
	// +optional
	// +kubebuilder:default=Pending
	Phase Phase `json:"phase,omitempty"`
}

type ConnectorImage struct {
	// Repository is the container image repository, for example
	// "docker.io/cloudflare/cloudflared". Defaults to the upstream
	// Cloudflare image.
	// +kubebuilder:default="docker.io/cloudflare/cloudflared"
	// +optional
	Repository string `json:"repository"`

	// Tag is the image tag. When omitted, the operator uses a
	// compile-time default bumped per operator release.
	// +optional
	Tag string `json:"tag,omitempty"`
}

type ConnectorSpec struct {
	// Enabled toggles whether the operator creates a cloudflared Deployment.
	// +kubebuilder:default=false
	// +optional
	Enabled bool `json:"enabled"`

	// Replicas is the desired pod count.
	// +kubebuilder:default=2
	// +kubebuilder:validation:Minimum=1
	// +optional
	Replicas int32 `json:"replicas"`

	// Image specifies the cloudflared container image. When omitted, the
	// operator uses a compile-time default bumped per operator release.
	// +optional
	Image *ConnectorImage `json:"image,omitempty"`

	// Resources are the container resource requests/limits.
	// +optional
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// NodeSelector is a pass-through to the pod spec.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Tolerations is a pass-through to the pod spec.
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// Affinity is a pass-through to the pod spec.
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// TopologySpreadConstraints is a pass-through to the pod spec.
	// +optional
	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`

	// NameOverride sets the base name for the operator-managed connector
	// resources. When set, the Deployment and ServiceAccount are named
	// exactly NameOverride and the ConfigMap is named "<NameOverride>-config".
	// When unset, names default to the "cloudflared-<tunnel.metadata.name>"
	// family (Deployment and ServiceAccount) and
	// "cloudflared-<tunnel.metadata.name>-config" (ConfigMap).
	//
	// On upgrade from operator versions that defaulted the base to
	// "<tunnel.metadata.name>-connector", the connector reconciler
	// automatically deletes the legacy-named resources owned by this
	// CloudflareTunnel after the new-named resources are running. Setting
	// NameOverride suppresses this auto-cleanup; the user is in charge.
	//
	// Changing NameOverride on a live tunnel reconciles new resources at the
	// new name; the old resources are not cleaned up automatically (see #52).
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +kubebuilder:validation:MaxLength=253
	// +optional
	NameOverride string `json:"nameOverride,omitempty"`
}

type ConnectorStatus struct {
	// Replicas is the desired pod count from the spec at last render.
	// +optional
	Replicas int32 `json:"replicas,omitempty"`

	// ReadyReplicas mirrors Deployment.status.readyReplicas.
	// +optional
	ReadyReplicas int32 `json:"readyReplicas,omitempty"`

	// ConfigHash is the sha256 hash of the rendered cloudflared config.yaml.
	// +optional
	ConfigHash string `json:"configHash,omitempty"`

	// Image is the image reference actually running.
	// +optional
	Image string `json:"image,omitempty"`
}

type DNSSettings struct {
	// CNAMEFlattening controls how the zone resolves CNAME records.
	// flatten_at_root: only flatten the apex (default Cloudflare behavior).
	// flatten_all: flatten every CNAME.
	// flatten_none: never flatten.
	// +kubebuilder:validation:Enum=flatten_at_root;flatten_all;flatten_none
	// +optional
	CNAMEFlattening *string `json:"cnameFlattening,omitempty"`
}

type MinifySettings struct {
	// CSS enables CSS minification.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	CSS *string `json:"css,omitempty"`

	// HTML enables HTML minification.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	HTML *string `json:"html,omitempty"`

	// JS enables JavaScript minification.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	JS *string `json:"js,omitempty"`
}

type NetworkSettings struct {
	// IPv6 enables IPv6 support.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	IPv6 *string `json:"ipv6,omitempty"`

	// WebSockets enables WebSocket support.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	WebSockets *string `json:"websockets,omitempty"`

	// PseudoIPv4 controls Pseudo IPv4 behavior.
	// +kubebuilder:validation:Enum=off;add_header;overwrite_header
	// +optional
	PseudoIPv4 *string `json:"pseudoIPv4,omitempty"`

	// IPGeolocation enables IP geolocation.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	IPGeolocation *string `json:"ipGeolocation,omitempty"`

	// OpportunisticOnion enables onion routing.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	OpportunisticOnion *string `json:"opportunisticOnion,omitempty"`
}

type PerformanceSettings struct {
	// CacheLevel controls the cache level.
	// +kubebuilder:validation:Enum=aggressive;basic;simplified
	// +optional
	CacheLevel *string `json:"cacheLevel,omitempty"`

	// BrowserCacheTTL is the browser cache TTL in seconds. 0 means respect existing headers.
	// +kubebuilder:validation:Minimum=0
	// +optional
	BrowserCacheTTL *int `json:"browserCacheTTL,omitempty"`

	// Minify controls minification settings.
	// +optional
	Minify *MinifySettings `json:"minify,omitempty"`

	// Polish controls image optimization.
	// +kubebuilder:validation:Enum=off;lossless;lossy
	// +optional
	Polish *string `json:"polish,omitempty"`

	// Brotli enables brotli compression.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	Brotli *string `json:"brotli,omitempty"`

	// EarlyHints enables early hints.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	EarlyHints *string `json:"earlyHints,omitempty"`

	// HTTP2 enables HTTP/2.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	HTTP2 *string `json:"http2,omitempty"`

	// HTTP3 enables HTTP/3.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	HTTP3 *string `json:"http3,omitempty"`

	// AlwaysOnline serves cached pages when the origin is unreachable.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	AlwaysOnline *string `json:"alwaysOnline,omitempty"`

	// RocketLoader defers JavaScript loading to improve perceived performance.
	// Cloudflare is sunsetting Rocket Loader; the field will be removed when
	// the API is retired.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	RocketLoader *string `json:"rocketLoader,omitempty"`
}

type Phase string

type RuleLogging struct {
	// Enabled opts the rule into per-action logging. Useful for actions
	// (e.g. skip) where logging is off by default.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`
}

type RulesetRuleSpec struct {
	// Action is the action to perform when the rule matches.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=block;challenge;js_challenge;managed_challenge;log;skip;execute;redirect;rewrite;route;score;serve_error;set_cache_settings;set_config;compress_response;force_connection_close
	Action string `json:"action"`

	// Expression is the filter expression for the rule.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Expression string `json:"expression"`

	// Description is an informative description of the rule.
	// +optional
	Description string `json:"description,omitempty"`

	// Enabled indicates whether the rule is active.
	// +kubebuilder:default=true
	// +optional
	Enabled *bool `json:"enabled,omitempty"`

	// ActionParameters contains action-specific parameters as free-form JSON.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	// +optional
	ActionParameters *apiextensionsv1.JSON `json:"actionParameters,omitempty"`

	// Logging configures per-rule logging behavior. Sibling of ActionParameters
	// in the Cloudflare API; do not encode logging via ActionParameters.
	// +optional
	Logging *RuleLogging `json:"logging,omitempty"`
}

type SRVData struct {
	// Service is the SRV service name (e.g., "_satisfactory").
	// +kubebuilder:validation:Required
	Service string `json:"service"`

	// Proto is the SRV protocol.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=_tcp;_udp;_tls
	Proto string `json:"proto"`

	// Priority of the SRV record.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	Priority int `json:"priority"`

	// Weight of the SRV record.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	Weight int `json:"weight"`

	// Port is the target port.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	Port int `json:"port"`

	// Target is the target hostname for the SRV record.
	// +kubebuilder:validation:Required
	Target string `json:"target"`
}

type SSLSettings struct {
	// Mode is the SSL mode.
	// +kubebuilder:validation:Enum=off;flexible;full;strict
	// +optional
	Mode *string `json:"mode,omitempty"`

	// MinTLSVersion is the minimum TLS version.
	// +kubebuilder:validation:Enum="1.0";"1.1";"1.2";"1.3"
	// +optional
	MinTLSVersion *string `json:"minTLSVersion,omitempty"`

	// TLS13 controls TLS 1.3 setting.
	// +kubebuilder:validation:Enum=on;off;zrt
	// +optional
	TLS13 *string `json:"tls13,omitempty"`

	// AlwaysUseHTTPS redirects all HTTP requests to HTTPS.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	AlwaysUseHTTPS *string `json:"alwaysUseHTTPS,omitempty"`

	// AutomaticHTTPSRewrites rewrites HTTP URLs to HTTPS in page content.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	AutomaticHTTPSRewrites *string `json:"automaticHTTPSRewrites,omitempty"`

	// OpportunisticEncryption enables opportunistic encryption.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	OpportunisticEncryption *string `json:"opportunisticEncryption,omitempty"`
}

type SecretReference struct {
	// Name of the Secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the Secret. Defaults to the dependent CR's own namespace
	// when empty.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type SecurityHeaderSettings struct {
	// Enabled toggles HSTS for the zone.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`

	// MaxAge is the HSTS max-age in seconds.
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=31536000
	// +optional
	MaxAge *int `json:"maxAge,omitempty"`

	// IncludeSubdomains extends HSTS to subdomains.
	// +optional
	IncludeSubdomains *bool `json:"includeSubdomains,omitempty"`

	// Preload requests inclusion in browser HSTS preload lists.
	// +optional
	Preload *bool `json:"preload,omitempty"`

	// Nosniff enables the X-Content-Type-Options: nosniff response header.
	// +optional
	Nosniff *bool `json:"nosniff,omitempty"`
}

type SecuritySettings struct {
	// SecurityLevel controls the security level.
	// +kubebuilder:validation:Enum=essentially_off;low;medium;high;under_attack
	// +optional
	SecurityLevel *string `json:"securityLevel,omitempty"`

	// ChallengeTTL is the challenge TTL in seconds.
	// +kubebuilder:validation:Enum=300;900;1800;2700;3600;7200;10800;14400;28800;57600;86400
	// +optional
	ChallengeTTL *int `json:"challengeTTL,omitempty"`

	// BrowserCheck enables browser integrity check.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	BrowserCheck *string `json:"browserCheck,omitempty"`

	// EmailObfuscation enables email obfuscation.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	EmailObfuscation *string `json:"emailObfuscation,omitempty"`

	// SecurityHeader configures the zone's HSTS / Strict-Transport-Security header.
	// +optional
	SecurityHeader *SecurityHeaderSettings `json:"securityHeader,omitempty"`

	// ServerSideExclude hides sensitive content from suspicious visitors.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	ServerSideExclude *string `json:"serverSideExclude,omitempty"`

	// HotlinkProtection blocks hotlinking of images.
	// +kubebuilder:validation:Enum=on;off
	// +optional
	HotlinkProtection *string `json:"hotlinkProtection,omitempty"`
}

type TunnelReference struct {
	// Name of the CloudflareTunnel resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the CloudflareTunnel. Defaults to the rule's own namespace
	// when empty.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type TunnelRoutingSpec struct {
	// DefaultBackend handles traffic that no CloudflareTunnelRule matches.
	// Omit to fall through to the auto-appended http_status:404.
	// +optional
	DefaultBackend *TunnelRuleBackend `json:"defaultBackend,omitempty"`

	// OriginRequest defaults applied to all rules unless overridden.
	// +optional
	OriginRequest *TunnelRuleOriginRequest `json:"originRequest,omitempty"`
}

type TunnelRuleBackend struct {
	// ServiceRef routes to a Kubernetes Service by reference. The operator
	// resolves the URL from cluster DNS at render time.
	// +optional
	ServiceRef *TunnelRuleServiceRef `json:"serviceRef,omitempty"`

	// URL is a raw backend URL. Use for sources (Gateway-upstream overrides)
	// where the backend is not expressible as a Service reference.
	// +optional
	URL *string `json:"url,omitempty"`

	// HTTPStatus produces a cloudflared http_status:<code> entry. Use for
	// explicit "reject at this hostname" rules.
	// +optional
	HTTPStatus *int `json:"httpStatus,omitempty"`
}

type TunnelRuleOriginRequest struct {
	// +optional
	NoTLSVerify bool `json:"noTLSVerify,omitempty"`
	// +optional
	OriginServerName string `json:"originServerName,omitempty"`
	// +optional
	ConnectTimeout *metav1.Duration `json:"connectTimeout,omitempty"`
	// +optional
	HTTPHostHeader string `json:"httpHostHeader,omitempty"`
}

type TunnelRuleServiceRef struct {
	// Name of the Service.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the Service. Defaults to the rule's namespace when empty.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Port may be an integer or a named port.
	// +kubebuilder:validation:Required
	Port intstr.IntOrString `json:"port"`

	// Scheme is http, https, h2c, or tcp. When empty, inferred at reconcile
	// time from the Service's port name.
	// +kubebuilder:validation:Enum=http;https;h2c;tcp
	// +optional
	Scheme string `json:"scheme,omitempty"`
}

type TunnelRuleSourceRef struct {
	// +optional
	APIVersion string `json:"apiVersion,omitempty"`
	// +optional
	Kind string `json:"kind,omitempty"`
	// +optional
	Namespace string `json:"namespace,omitempty"`
	// +optional
	Name string `json:"name,omitempty"`
	// +optional
	UID string `json:"uid,omitempty"`
}

type ZoneReference struct {
	// Name of the CloudflareZone resource.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the CloudflareZone. Defaults to the referencing CR's own
	// namespace when empty.
	// +optional
	Namespace string `json:"namespace,omitempty"`
}