v1alpha1

type AWGConfig struct {
	// SecretName is the name of the Secret containing AWG configuration.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	SecretName string `json:"secretName"`

	// InterfacePrefix is the AWG network interface name prefix.
	// The kernel auto-numbers interfaces using this prefix (e.g., awg-cfd0, awg-cfd1).
	// Different GatewayClassConfigs should use different prefixes to avoid conflicts.
	// +optional
	// +kubebuilder:default="awg-cfd"
	InterfacePrefix string `json:"interfacePrefix,omitempty"`
}

type CloudflaredConfig struct {
	// Enabled controls whether the controller manages cloudflared deployment.
	// When true, the controller will deploy cloudflared via Helm.
	// +optional
	// +kubebuilder:default=true
	Enabled *bool `json:"enabled,omitempty"`

	// Replicas is the number of cloudflared pods to run.
	// +optional
	// +kubebuilder:default=1
	// +kubebuilder:validation:Minimum=1
	Replicas int32 `json:"replicas,omitempty"`

	// Namespace is the namespace for cloudflared deployment.
	// +optional
	// +kubebuilder:default="cloudflare-tunnel-system"
	Namespace string `json:"namespace,omitempty"`

	// Protocol is the transport protocol for cloudflared.
	// +optional
	// +kubebuilder:validation:Enum=auto;quic;http2;""
	Protocol string `json:"protocol,omitempty"`

	// AWG configures the AmneziaWG sidecar.
	// +optional
	AWG *AWGConfig `json:"awg,omitempty"`
}

type GatewayClassConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"` //nolint:modernize // kubebuilder standard

	Spec   GatewayClassConfigSpec   `json:"spec,omitempty"`   //nolint:modernize // kubebuilder standard
	Status GatewayClassConfigStatus `json:"status,omitempty"` //nolint:modernize // kubebuilder standard
}

type GatewayClassConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"` //nolint:modernize // kubebuilder standard

	Items []GatewayClassConfig `json:"items"`
}

type GatewayClassConfigSpec struct {
	// CloudflareCredentialsSecretRef references a Secret containing Cloudflare API credentials.
	// The Secret must contain an "api-token" key with a valid Cloudflare API token.
	// +kubebuilder:validation:Required
	CloudflareCredentialsSecretRef SecretReference `json:"cloudflareCredentialsSecretRef"`

	// AccountID is the Cloudflare account ID. Optional - if not specified, it will be
	// read from the credentials secret ("account-id" key) or auto-detected if the API token
	// has access to only one account.
	// +optional
	AccountID string `json:"accountId,omitempty"`

	// TunnelID is the Cloudflare Tunnel UUID.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$`
	TunnelID string `json:"tunnelID"` //nolint:tagliatelle // Cloudflare API uses tunnelID

	// TunnelTokenSecretRef references a Secret containing the tunnel token.
	// Required when cloudflared.enabled is true.
	// The Secret must contain a "tunnel-token" key.
	// +optional
	TunnelTokenSecretRef *SecretReference `json:"tunnelTokenSecretRef,omitempty"`

	// Cloudflared configures the cloudflared deployment.
	// +optional
	Cloudflared CloudflaredConfig `json:"cloudflared,omitempty"` //nolint:modernize // kubebuilder standard
}

type GatewayClassConfigStatus struct {
	// Conditions describe the current state of the GatewayClassConfig.
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type SecretReference struct {
	// Name of the Secret.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Namespace of the Secret. Defaults to the namespace of the referencing resource.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Key in the Secret. Defaults depend on context:
	// - For cloudflareCredentialsSecretRef: "api-token"
	// - For tunnelTokenSecretRef: "tunnel-token"
	// +optional
	Key string `json:"key,omitempty"`
}