v1

type ExternalVPNSpec struct {
	// Connection is the Wireguard connection configuration
	Connection WireguardConnectionSpec `json:"connection"`

	// Credentials are the external VPN Wireguard credentials
	Credentials WireguardCredentialsSpec `json:"credentials"`
}

type FirewallRuleSpec struct {

	// Protocol is the network protocol
	// If not specified, the default protocol of ALL is used
	//+optional
	Protocol Protocol `json:"protocol"`

	// StartPort is the start port for a range of ports
	// If the end port is not specified, the default end port is the same as the start port
	StartPort uint16 `json:"startPort"`

	// EndPort is the end port for a range of ports
	// If not specified, the default end port is the same as the start port
	//+optional
	EndPort uint16 `json:"endPort,omitempty"`

	// IP is the IP address of the subject
	// Either an IP or CIDR must be specified
	//+optional
	IP string `json:"ip,omitempty"`

	// CIDR is the CIDR block of the subject
	// Either an IP or CIDR must be specified
	//+optional
	CIDR string `json:"cidr,omitempty"`
}

type FirewallRulesSpec struct {
	// Allow is a list of firewall rules to allow traffic
	//+optional
	Allow []FirewallRuleSpec `json:"allow,omitempty"`

	// Block is a list of firewall rules to block traffic
	//+optional
	Block []FirewallRuleSpec `json:"block,omitempty"`
}

type FirewallSpec struct {

	// Enabled is a flag to enable the firewall.
	// The default firewall configuration is to block all non-VPN traffic, aka a kill switch.
	//+optional
	Enabled bool `json:"enabled"`

	// AllowWorkloadNetworkChanges is a flag to allow pods that could potentially make changes to the workload network
	// This is disabled by default and will reject any containers with the NET_RAW or NET_ADMIN capabilities as
	// these capabilities can be used to make changes to the network. Enabling this flag will allow containers with
	// these capabilities to be deployed.
	//+optional
	AllowWorkloadNetworkChanges bool `json:"allowWorkloadNetworkChanges,omitempty"`

	// Egress is a list of egress firewall rules
	// These rules are applied to traffic leaving the container
	// The default egress rules are to block all RFC1918 IPs and allow all other traffic
	//+optional
	Egress []FirewallRulesSpec `json:"egress,omitempty"`

	// Ingress is a list of ingress firewall rules
	// These rules are applied to traffic entering the container
	// The default ingress rules are to block all traffic
	//+optional
	Ingress []FirewallRulesSpec `json:"ingress,omitempty"`
}

type InitSpec struct {

	// Image is the container image
	// If not specified, the default image of ghcr.io/usa-reddragon/wireguard:main is used
	//+optional
	Image string `json:"image,omitempty"`
}

type NameSelectorSpec struct {
	// Name is the name of the resource
	Name string `json:"name"`
}

type Network struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   NetworkSpec   `json:"spec,omitempty"`
	Status NetworkStatus `json:"status,omitempty"`
}

type NetworkList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Network `json:"items"`
}

type NetworkSpec struct {

	// DNS is the optional DNS configuration
	//+optional
	DNS corev1.PodDNSConfig `json:"dns"`
}

type NetworkStatus struct {

	// Ready is a flag to indicate if the network is ready
	Ready bool `json:"ready"`

	// ID is the ID of the network
	ID string `json:"id,omitempty"`

	// Status is the status of the network
	Status uint8 `json:"status,omitempty"`
}

type Peer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PeerSpec   `json:"spec,omitempty"`
	Status PeerStatus `json:"status,omitempty"`
}

type PeerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Peer `json:"items"`
}

type PeerSpec struct {

	// Network is the selector for the network this peer is a part of
	Network NameSelectorSpec `json:"network"`

	// Pods is the selector for the pods that are peers in the network
	Pods metav1.LabelSelector `json:"pods"`

	// Init is the optional initial container configuration that is applied to the peer
	//+optional
	Init InitSpec `json:"init,omitempty"`

	// Firewall is the optional firewall configuration that is applied to the peer
	//+optional
	Firewall FirewallSpec `json:"firewall,omitempty"`
}

type PeerStatus struct {

	// Ready is a flag to indicate if the peer is ready
	Ready bool `json:"ready"`

	// ID is the ID of the peer
	ID string `json:"id,omitempty"`

	// Status is the status of the peer
	Status uint8 `json:"status,omitempty"`
}

type Protocol string

type Router struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RouterSpec   `json:"spec,omitempty"`
	Status RouterStatus `json:"status,omitempty"`
}

type RouterList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Router `json:"items"`
}

type RouterSpec struct {

	// Replicas is the number of router replicas
	// This defaults to 0, the same as disabling the router
	//+optional
	Replicas int32 `json:"replicas,omitempty"`

	// Network is the selector for the network this peer is a part of
	Network NameSelectorSpec `json:"network"`

	// Image is the container image for the router
	// This defaults to ghcr.io/usa-reddragon/wireguard:main
	Image string `json:"image,omitempty"`

	// DNS is the optional DNS configuration
	// This overrides the default DNS configuration from the Network
	//+optional
	DNS corev1.PodDNSConfig `json:"dns"`

	// ExternalVPN is the optional external VPN configuration
	// If specified, the router will route traffic through the external VPN
	// Paired with enabling the firewall, this can be used to create a VPN kill-switched
	// connection to an external VPN provider from all pods in the network
	//+optional
	ExternalVPN ExternalVPNSpec `json:"externalVPN,omitempty"`

	// Firewall is the optional firewall configuration that is applied to the peer
	//+optional
	Firewall FirewallSpec `json:"firewall,omitempty"`
}

type RouterStatus struct {

	// Ready is a flag to indicate if the network is ready
	Ready bool `json:"ready"`

	// ID is the ID of the network
	ID string `json:"id,omitempty"`

	// Status is the status of the network
	Status uint8 `json:"status,omitempty"`

	// Replicas is the number of router replicas
	Replicas int32 `json:"replicas"`

	// Selector is the selector for scaling the router pods
	Selector string `json:"selector"`
}

type WireguardConnectionSpec struct {
	// Address is the IP address or hostname of the Wireguard server
	//+optional
	Address string `json:"address,omitempty"`

	// Port is the port of the Wireguard server
	//+optional
	Port uint16 `json:"port,omitempty"`

	// Secret is the selector for the secret containing the Wireguard connection configuration in the keys "address" and "port"
	//+optional
	Secret NameSelectorSpec `json:"secret,omitempty"`
}

type WireguardCredentialsSpec struct {

	// PrivateKey is the 44-character private key for the Wireguard client in base64 format
	PrivateKey WireguardKey `json:"privateKey,omitempty"`

	// PeerPublicKey is the 44-character public key for the peer in base64 format
	PeerPublicKey WireguardKey `json:"peerPublicKey,omitempty"`

	// PreSharedKey is the optional pre-shared key for the Wireguard connection
	//+optional
	PreSharedKey string `json:"preSharedKey,omitempty"`

	// Secret is the name of the secret containing the Wireguard credentials in the keys "privateKey", "peerPublicKey", and "preSharedKey"
	//+optional
	Secret NameSelectorSpec `json:"secret,omitempty"`
}

type WireguardKey string