pod

type Container struct {
	ID         string            `json:"id"`
	RootfsTag  string            `json:"rootfs_tag"`        // matches a Share.Tag (virtio-fs) OR a local dir under /run/weft/rootfs/<id>
	Command    []string          `json:"command,omitempty"` // overrides image entrypoint
	Args       []string          `json:"args,omitempty"`
	Env        map[string]string `json:"env,omitempty"`
	Workdir    string            `json:"workdir,omitempty"`
	User       string            `json:"user,omitempty"` // "uid:gid" or username
	Restart    RestartPolicy     `json:"restart,omitempty"`
	Mounts     []Mount           `json:"mounts,omitempty"`
	Resources  Resources         `json:"resources,omitempty"`
	Privileged bool              `json:"privileged,omitempty"`
}

type CubeFSMount struct {
	// Volume is the CubeFS volume name (the platform "share" maps 1:1 to
	// a CubeFS volume).
	Volume string `json:"volume"`

	// Masters are the CubeFS master node addresses ("host:port"), reached
	// over the wg0 overlay.
	Masters []string `json:"masters"`

	// Owner is the volume owner CubeFS authorizes against.
	Owner string `json:"owner"`

	// AccessKey / SecretKey authenticate to CubeFS (the volume's keypair).
	AccessKey string `json:"access_key,omitempty"`
	SecretKey string `json:"secret_key,omitempty"`

	// SubDir optionally mounts only a subtree of the volume.
	SubDir string `json:"subdir,omitempty"`
}

type Firewall struct {
	Rules []FirewallRule `json:"rules"`
}

type FirewallRule struct {
	// Direction is "ingress" (traffic into the VM) or "egress" (traffic
	// out of the VM). Empty is rejected by Validate.
	Direction string `json:"direction"`
	// Protocol is "tcp", "udp", "icmp" (any code/type), or "" meaning any
	// L4 protocol. PortMin/PortMax are ignored when Protocol is "" or
	// "icmp".
	Protocol string `json:"protocol,omitempty"`
	// PortMin / PortMax describe an inclusive destination port range
	// (for ingress) or source port range (for egress). 0 = unset; if
	// set, PortMin must be ≤ PortMax. A single port is encoded as
	// PortMin == PortMax.
	PortMin uint16 `json:"port_min,omitempty"`
	PortMax uint16 `json:"port_max,omitempty"`
	// RemoteCIDR is the peer subnet matched on the rule. Empty means
	// any. Validated as a parseable CIDR by Validate.
	RemoteCIDR string `json:"remote_cidr,omitempty"`
}

type FirewallStatus struct {
	// Overall is "Healthy" when the reconciler successfully read
	// the kernel table on the last poll, "Degraded" when the
	// nftables read errored. Defined as a string so the UI can
	// render unknown future states without code churn.
	Overall string `json:"Overall"`
	// TableInstalled is true when the "weft-fw" table is present
	// in the kernel ; false when no ruleset has been applied yet
	// (fresh boot before the first publish lands) or it was
	// flushed externally.
	TableInstalled bool `json:"TableInstalled"`
	// RulesInstalled is the total number of nftables rules across
	// the input + output chains, including the unconditional
	// ct/lo accepts the reconciler always installs. The UI
	// subtracts those defaults to show the tenant-visible count.
	RulesInstalled int `json:"RulesInstalled"`
	// LastError carries the most recent read error message ;
	// empty on success. Surfaced so an operator can tell
	// "reconciler crashed" from "no policy yet" without ssh-ing
	// into the guest.
	LastError string `json:"LastError,omitempty"`
	// PublishedAtUnix is the wall-clock time of this status
	// message (set by the emitter, not by the reconciler).
	PublishedAtUnix int64 `json:"PublishedAtUnix"`
}

type Mount struct {
	Source      string   `json:"source"`
	Destination string   `json:"destination"`
	Type        string   `json:"type,omitempty"` // "bind" | "tmpfs"
	Options     []string `json:"options,omitempty"`
}

type MountAction string

type Network struct {
	Interface string   `json:"interface,omitempty"` // default "eth0"
	Address   string   `json:"address,omitempty"`   // CIDR, e.g. "10.0.2.15/24"
	Gateway   string   `json:"gateway,omitempty"`
	DNS       []string `json:"dns,omitempty"`
	Hostname  string   `json:"hostname,omitempty"`
}

type Resources struct {
	CPUShares uint64 `json:"cpu_shares,omitempty"`
	MemBytes  uint64 `json:"mem_bytes,omitempty"`
	PidsMax   int64  `json:"pids_max,omitempty"`
}

type RestartPolicy string

type Share struct {
	Tag        string `json:"tag"`         // virtio-fs tag, e.g. "rootfs0"
	MountPoint string `json:"mount_point"` // where init mounts it inside the guest, e.g. "/run/weft/rootfs/web"
	Readonly   bool   `json:"readonly,omitempty"`
}

type ShareMount struct {
	// ID is a stable handle, required so a later unmount (or re-publish)
	// targets the same mount deterministically.
	ID string `json:"id"`

	// Action is "" / "mount" or "unmount". Unmount only needs ID + MountPoint.
	Action MountAction `json:"action,omitempty"`

	// Backend selects the storage backend. Empty defaults to CubeFS.
	Backend string `json:"backend,omitempty"`

	// MountPoint is the absolute guest path the share appears at, e.g.
	// "/run/weft/shares/team-data". Bind-mount it into containers via
	// Container.Mounts to expose it to a workload.
	MountPoint string `json:"mount_point"`

	// Readonly mounts the share read-only.
	Readonly bool `json:"readonly,omitempty"`

	// CubeFS carries the CubeFS connection details (required when Backend
	// is CubeFS / empty).
	CubeFS *CubeFSMount `json:"cubefs,omitempty"`
}

type Spec struct {
	PodID       string            `json:"pod_id"`
	Containers  []Container       `json:"containers"`
	Shares      []Share           `json:"shares,omitempty"`
	Network     *Network          `json:"network,omitempty"`
	WireGuard   *WireGuard        `json:"wireguard,omitempty"`
	ShareMounts []ShareMount      `json:"share_mounts,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
}

type WGPeer struct {
	PublicKey           string   `json:"public_key"`                     // base64, 32 bytes
	Endpoint            string   `json:"endpoint,omitempty"`             // underlay "host:port"
	AllowedIPs          []string `json:"allowed_ips"`                    // overlay CIDRs routed to this peer
	PersistentKeepalive uint16   `json:"persistent_keepalive,omitempty"` // seconds; 0 = disabled
}

type WireGuard struct {
	Interface  string   `json:"interface,omitempty"`   // default "wg0"
	PrivateKey string   `json:"private_key"`           // base64, 32 bytes
	ListenPort uint16   `json:"listen_port,omitempty"` // UDP underlay port; 0 = ephemeral
	Address    string   `json:"address"`               // overlay CIDR, e.g. "10.9.0.1/24"
	Peers      []WGPeer `json:"peers,omitempty"`
}