config

type AgentConfig struct {
	Enabled *bool  `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	Socket  string `yaml:"socket,omitempty" json:"socket,omitempty"`
	DataDir string `yaml:"dataDir,omitempty" json:"dataDir,omitempty"`
}

type BackupConfig struct {
	Schedule string               `yaml:"schedule" json:"schedule"`                   // cron format (e.g., "0 2 * * *")
	Retain   int                  `yaml:"retain" json:"retain"`                       // days to retain backups
	Volumes  []string             `yaml:"volumes,omitempty" json:"volumes,omitempty"` // optional logical service volumes to back up
	Storage  *BackupStorageConfig `yaml:"storage,omitempty" json:"storage,omitempty"` // optional object storage target
}

type BackupStorageConfig struct {
	Provider        string `yaml:"provider,omitempty" json:"provider,omitempty"`               // s3, r2, s3-compatible
	Bucket          string `yaml:"bucket,omitempty" json:"bucket,omitempty"`                   // Object storage bucket
	Region          string `yaml:"region,omitempty" json:"region,omitempty"`                   // AWS region or "auto" for R2
	Endpoint        string `yaml:"endpoint,omitempty" json:"endpoint,omitempty"`               // Required for r2/s3-compatible
	Prefix          string `yaml:"prefix,omitempty" json:"prefix,omitempty"`                   // Optional object key prefix
	AccessKeyID     string `yaml:"accessKeyId,omitempty" json:"accessKeyId,omitempty"`         // Use ${ENV_VAR}
	SecretAccessKey string `yaml:"secretAccessKey,omitempty" json:"secretAccessKey,omitempty"` // Use ${ENV_VAR}
	SessionToken    string `yaml:"sessionToken,omitempty" json:"sessionToken,omitempty"`       // Optional temporary credential token
	ForcePathStyle  bool   `yaml:"forcePathStyle,omitempty" json:"forcePathStyle,omitempty"`   // Needed by some S3-compatible stores
}

type BuildConfig struct {
	Strategy string `yaml:"strategy,omitempty" json:"strategy,omitempty"` // remote, local, auto
}

type CacheConfig struct {
	Enabled   bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`     // Enable build caching (default: true)
	Type      string `yaml:"type,omitempty" json:"type,omitempty"`           // "local" (default), "registry"
	Retention string `yaml:"retention,omitempty" json:"retention,omitempty"` // Cache retention period (e.g., "7d")
}

type Config struct {
	Schema        string                       `yaml:"$schema,omitempty" json:"$schema,omitempty"` // JSON Schema reference
	Project       ProjectConfig                `yaml:"project" json:"project"`
	Runtime       *RuntimeConfig               `yaml:"runtime,omitempty" json:"runtime,omitempty"`
	Mesh          *MeshConfig                  `yaml:"mesh,omitempty" json:"mesh,omitempty"`
	State         *StateConfig                 `yaml:"state,omitempty" json:"state,omitempty"`
	Deployment    *DeploymentConfig            `yaml:"deployment,omitempty" json:"deployment,omitempty"`
	Notifications *NotificationsConfig         `yaml:"notifications,omitempty" json:"notifications,omitempty"`
	Volumes       map[string]VolumeConfig      `yaml:"volumes,omitempty" json:"volumes,omitempty"` // Top-level volume definitions
	Builds        map[string]SharedBuildConfig `yaml:"builds,omitempty" json:"builds,omitempty"`
	// Registries holds private image registry credentials keyed by host
	// (e.g. ghcr.io). Values must be ${ENV_VAR} references — literal
	// passwords in the config file are rejected at load time. Credentials
	// are request-scoped: they ride individual pull/build requests and are
	// never persisted on nodes.
	Registries map[string]RegistryConfig `yaml:"registries,omitempty" json:"registries,omitempty"`

	Servers      map[string]ServerConfig      `yaml:"servers" json:"servers"`
	Environments map[string]EnvironmentConfig `yaml:"environments" json:"environments"`
}

type DeployConfig struct {
	Strategy          string                `yaml:"strategy,omitempty" json:"strategy,omitempty"` // recreate, rolling, blue_green
	MaxUnavailable    int                   `yaml:"maxUnavailable,omitempty" json:"maxUnavailable,omitempty"`
	MaxSurge          int                   `yaml:"maxSurge,omitempty" json:"maxSurge,omitempty"`
	RollbackOnFailure bool                  `yaml:"rollbackOnFailure,omitempty" json:"rollbackOnFailure,omitempty"`
	Readiness         DeployReadinessConfig `yaml:"readiness,omitempty" json:"readiness,omitempty"`
	SmokeTest         DeploySmokeTestConfig `yaml:"smokeTest,omitempty" json:"smokeTest,omitempty"`
	Promotion         string                `yaml:"promotion,omitempty" json:"promotion,omitempty"` // automatic, manual
	GracePeriod       string                `yaml:"gracePeriod,omitempty" json:"gracePeriod,omitempty"`
	Release           *ReleaseConfig        `yaml:"release,omitempty" json:"release,omitempty"`
}

type DeployReadinessConfig struct {
	Path     string `yaml:"path,omitempty" json:"path,omitempty"`
	TCPPort  int    `yaml:"tcpPort,omitempty" json:"tcpPort,omitempty"`
	Timeout  string `yaml:"timeout,omitempty" json:"timeout,omitempty"`
	Interval string `yaml:"interval,omitempty" json:"interval,omitempty"`
	Retries  int    `yaml:"retries,omitempty" json:"retries,omitempty"`
}

type DeploySmokeTestConfig struct {
	Path           string `yaml:"path,omitempty" json:"path,omitempty"`
	ExpectedStatus int    `yaml:"expectedStatus,omitempty" json:"expectedStatus,omitempty"`
}

type DeploymentConfig struct {
	Strategy string          `yaml:"strategy,omitempty" json:"strategy,omitempty"` // "parallel" or "sequential" (default: sequential)
	Parallel *ParallelConfig `yaml:"parallel,omitempty" json:"parallel,omitempty"`
	Cache    *CacheConfig    `yaml:"cache,omitempty" json:"cache,omitempty"`
	Build    *BuildConfig    `yaml:"build,omitempty" json:"build,omitempty"`
}

type DynamicDomainsConfig struct {
	Enabled *bool  `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	Ask     string `yaml:"ask,omitempty" json:"ask,omitempty"` // "<service>:<path>"
}

type EnvironmentACMEConfig struct {
	DNSProvider string            `yaml:"dnsProvider" json:"dnsProvider"`
	Credentials map[string]string `yaml:"credentials" json:"credentials"`
}

type EnvironmentConfig struct {
	Servers        []string                 `yaml:"servers" json:"servers"`                                   // List of server names to use
	ServerSelector *ServerSelector          `yaml:"serverSelector,omitempty" json:"serverSelector,omitempty"` // Label-based server selection
	Proxy          *EnvironmentProxyConfig  `yaml:"proxy,omitempty" json:"proxy,omitempty"`                   // Environment-level proxy placement
	Labels         map[string]string        `yaml:"labels,omitempty" json:"labels,omitempty"`                 // Environment labels for nodes
	Services       map[string]ServiceConfig `yaml:"services" json:"services"`                                 // Services to deploy in this environment
}

type EnvironmentProxyConfig struct {
	Placement *PlacementConfig `yaml:"placement,omitempty" json:"placement,omitempty"`
	// ACME is the environment-scoped DNS-01 provider used by routes that
	// explicitly opt in. Raw credential values must be whole ${ENV_VAR}
	// references and never enter route manifests or replicated state.
	ACME *EnvironmentACMEConfig `yaml:"acme,omitempty" json:"acme,omitempty"`
}

type HealthCheckConfig struct {
	Command     string `yaml:"command,omitempty" json:"command,omitempty"`
	Path        string `yaml:"path" json:"path"`
	TCPPort     int    `yaml:"tcpPort,omitempty" json:"tcpPort,omitempty"`
	Interval    string `yaml:"interval" json:"interval"`
	Timeout     string `yaml:"timeout" json:"timeout"`
	Retries     int    `yaml:"retries" json:"retries"`
	StartPeriod string `yaml:"startPeriod,omitempty" json:"startPeriod,omitempty"` // Grace period before starting checks
}

type LoadBalancerConfig struct {
	Strategy    string                  `yaml:"strategy" json:"strategy"` // round_robin, sticky
	HealthCheck LoadBalancerHealthCheck `yaml:"healthCheck,omitempty" json:"healthCheck,omitempty"`
}

type LoadBalancerHealthCheck struct {
	Enabled  bool   `yaml:"enabled" json:"enabled"`
	Path     string `yaml:"path" json:"path"`
	Interval string `yaml:"interval" json:"interval"`
}

type MeshConfig struct {
	Enabled      *bool  `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	NetworkCIDR  string `yaml:"networkCIDR,omitempty" json:"networkCIDR,omitempty"`
	Interface    string `yaml:"interface,omitempty" json:"interface,omitempty"`
	ListenPort   int    `yaml:"listenPort,omitempty" json:"listenPort,omitempty"`
	SubnetBits   int    `yaml:"subnetBits,omitempty" json:"subnetBits,omitempty"`
	NATTraversal bool   `yaml:"natTraversal,omitempty" json:"natTraversal,omitempty"`
}

type MonitoringConfig struct {
	Enabled   bool   `yaml:"enabled" json:"enabled"`                         // Enable monitoring for this service
	Interval  string `yaml:"interval,omitempty" json:"interval,omitempty"`   // Check interval (e.g., "60s")
	Webhook   string `yaml:"webhook,omitempty" json:"webhook,omitempty"`     // Webhook URL for alerts
	CheckType string `yaml:"checkType,omitempty" json:"checkType,omitempty"` // "http" or "container" (default: auto-detect)
}

type NotificationsConfig struct {
	Slack   string `yaml:"slack,omitempty" json:"slack,omitempty"`     // Slack webhook URL
	Discord string `yaml:"discord,omitempty" json:"discord,omitempty"` // Discord webhook URL
	Webhook string `yaml:"webhook,omitempty" json:"webhook,omitempty"` // Generic webhook URL
}

type ParallelConfig struct {
	MaxConcurrentBuilds  int    `yaml:"maxConcurrentBuilds,omitempty" json:"maxConcurrentBuilds,omitempty"`   // Default: 4
	MaxConcurrentDeploys int    `yaml:"maxConcurrentDeploys,omitempty" json:"maxConcurrentDeploys,omitempty"` // Default: 4
	Strategy             string `yaml:"strategy,omitempty" json:"strategy,omitempty"`                         // "dependency-aware" (default), "resource-aware", "round-robin"
}

type PlacementConfig struct {
	Strategy    string   `yaml:"strategy,omitempty" json:"strategy,omitempty"`       // "spread", "pinned", "any", "global"
	Servers     []string `yaml:"servers,omitempty" json:"servers,omitempty"`         // Pin to specific servers (for "pinned" strategy)
	Constraints []string `yaml:"constraints,omitempty" json:"constraints,omitempty"` // Node label constraints (e.g., "node.labels.type==high-memory")
	Preferences []string `yaml:"preferences,omitempty" json:"preferences,omitempty"` // Placement preferences (e.g., "spread=node.labels.region")
}

type PortPublish struct {
	// HostIP restricts the bind address; empty binds all interfaces.
	HostIP        string
	HostPort      int
	ContainerPort int
	// Protocol is "tcp" or "udp".
	Protocol string
}

type ProjectConfig struct {
	Name    string `yaml:"name" json:"name"`
	Version string `yaml:"version" json:"version"`
}

type ProxyBasicAuthConfig struct {
	Username string `yaml:"username" json:"username"`
	// PasswordBcrypt is the pre-computed bcrypt hash of the password —
	// never the plaintext. Mint one with `tako proxy hash-password`.
	// A pre-computed hash keeps redeploys idempotent (hashing at deploy
	// time would salt fresh every run and churn the proxy config).
	PasswordBcrypt string `yaml:"passwordBcrypt" json:"passwordBcrypt"`
}

type ProxyConfig struct {
	// Domain is where public traffic is served.
	Domain string `yaml:"domain,omitempty" json:"domain,omitempty"`

	// Domains adds co-equal serving hostnames beside Domain. Each serves
	// the same upstreams with its own ACME certificate; Domain stays the
	// primary for URL display and as the redirect target.
	Domains []string `yaml:"domains,omitempty" json:"domains,omitempty"`

	// Host is where internal traffic is served when visibility is internal.
	Host string `yaml:"host,omitempty" json:"host,omitempty"`

	// Visibility controls whether the route is public ACME-backed ingress or
	// private HTTP-only ingress intended for LAN/VPN/hosts-file resolution.
	Visibility string `yaml:"visibility,omitempty" json:"visibility,omitempty"`

	// CDN declares that public DNS intentionally terminates at an external
	// CDN. Domain readiness heuristics never substitute for this declaration.
	CDN string `yaml:"cdn,omitempty" json:"cdn,omitempty"`

	// RedirectFrom specifies domains that should redirect to the primary Domain
	// These domains will get their own TLS certificates and 301 redirect to Domain
	// Example: ["www.example.com", "old.example.com"] -> redirects to "example.com"
	RedirectFrom []string `yaml:"redirectFrom,omitempty" json:"redirectFrom,omitempty"`

	Email string    `yaml:"email,omitempty" json:"email,omitempty"` // Email for Let's Encrypt
	TLS   TLSConfig `yaml:"tls,omitempty" json:"tls,omitempty"`

	// DynamicDomains enables ask-gated on-demand TLS for customer domains.
	DynamicDomains *DynamicDomainsConfig `yaml:"dynamicDomains,omitempty" json:"dynamicDomains,omitempty"`

	// BasicAuth protects every serving domain of this route with HTTP
	// basic authentication before requests reach the service.
	BasicAuth *ProxyBasicAuthConfig `yaml:"basicAuth,omitempty" json:"basicAuth,omitempty"`

	// AllowIps restricts the route to the listed client IPs/CIDRs; other
	// addresses receive 403. It matches the TCP peer unless TrustedProxies
	// is configured, in which case it matches Caddy's parsed client IP.
	AllowIps []string `yaml:"allowIps,omitempty" json:"allowIps,omitempty"`

	// TrustedProxies declares the explicit proxy/CDN CIDRs whose forwarded
	// client IP headers Caddy may trust for this route. CIDRs only.
	TrustedProxies []string `yaml:"trustedProxies,omitempty" json:"trustedProxies,omitempty"`
}

type RegistryConfig struct {
	Username string `yaml:"username,omitempty" json:"username,omitempty"` // Use ${ENV_VAR}
	Password string `yaml:"password,omitempty" json:"password,omitempty"` // Use ${ENV_VAR}
}

type ReleaseConfig struct {
	Command []string `yaml:"command,omitempty" json:"command,omitempty"`
	Timeout string   `yaml:"timeout,omitempty" json:"timeout,omitempty"`
	// Volumes opts the release container into the service's volume mounts.
	Volumes bool `yaml:"volumes,omitempty" json:"volumes,omitempty"`
}

type ResourceLimitsConfig struct {
	Memory string `yaml:"memory,omitempty" json:"memory,omitempty"` // Docker memory limit, for example 512m or 1g
	CPUs   string `yaml:"cpus,omitempty" json:"cpus,omitempty"`     // Docker --cpus limit, for example 0.5 or 2
}

type RuntimeConfig struct {
	Mode  string       `yaml:"mode,omitempty" json:"mode,omitempty"` // takod
	Proxy string       `yaml:"proxy,omitempty" json:"proxy,omitempty"`
	Agent *AgentConfig `yaml:"agent,omitempty" json:"agent,omitempty"`
}

type ServerConfig struct {
	Host        string            `yaml:"host" json:"host"`
	PrivateHost string            `yaml:"privateHost,omitempty" json:"privateHost,omitempty"`
	User        string            `yaml:"user" json:"user"`
	Port        int               `yaml:"port,omitempty" json:"port,omitempty"`
	SSHKey      string            `yaml:"sshKey,omitempty" json:"sshKey,omitempty"`     // Path to SSH private key (mutually exclusive with password)
	Password    string            `yaml:"password,omitempty" json:"password,omitempty"` // SSH password (mutually exclusive with sshKey, use env var for security)
	Labels      map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`     // Custom labels for server selection
	// Transport controls routine takod traffic only. The empty value preserves
	// the historical SSH-first behavior. auto/local require the immutable IDs
	// below; privileged setup, join, repair, and upgrade remain SSH operations.
	Transport string `yaml:"transport,omitempty" json:"transport,omitempty"`
	ClusterID string `yaml:"clusterId,omitempty" json:"clusterId,omitempty"`
	NodeID    string `yaml:"nodeId,omitempty" json:"nodeId,omitempty"`
	WorkerUID int    `yaml:"workerUid,omitempty" json:"workerUid,omitempty"`
	// Platform-owned fields are materialized from the protected cluster
	// inventory and can never be supplied by application YAML/JSON.
	MeshIP                string   `yaml:"-" json:"-"`
	Lifecycle             string   `yaml:"-" json:"-"`
	Roles                 []string `yaml:"-" json:"-"`
	SSHHostKeyType        string   `yaml:"-" json:"-"`
	SSHHostKey            string   `yaml:"-" json:"-"`
	SSHHostKeyFingerprint string   `yaml:"-" json:"-"`
}

type ServerSelector struct {
	Labels map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"` // Match servers with these labels
	Any    bool              `yaml:"any,omitempty" json:"any,omitempty"`       // Select any available server
}

type ServiceConfig struct {

	// Kind selects the workload type: "service" (default, long-running
	// containers) or "job" (a command run on a cron schedule by takod).
	Kind string `yaml:"kind,omitempty" json:"kind,omitempty"`
	// Schedule is the cron expression for kind: job (five-field cron or
	// descriptors like @hourly). Evaluated in UTC unless timezone is set.
	Schedule string `yaml:"schedule,omitempty" json:"schedule,omitempty"`
	// Timezone is the IANA zone the schedule is evaluated in (kind: job).
	Timezone string `yaml:"timezone,omitempty" json:"timezone,omitempty"`
	// Timeout kills a job run after this duration (kind: job, default 1h).
	Timeout string `yaml:"timeout,omitempty" json:"timeout,omitempty"`

	// Build or Image (mutually exclusive)
	Build       string            `yaml:"build,omitempty" json:"build,omitempty"` // Path to build context (auto-detects Dockerfile)
	BuildArgs   map[string]string `yaml:"-" json:"-"`
	BuildTarget string            `yaml:"-" json:"-"`
	Dockerfile  string            `yaml:"dockerfile,omitempty" json:"dockerfile,omitempty"` // Dockerfile path relative to build context
	Image       string            `yaml:"image,omitempty" json:"image,omitempty"`           // Pre-built image (for postgres, redis, etc)
	ImageFrom   string            `yaml:"imageFrom,omitempty" json:"imageFrom,omitempty"`   // shared build, or source service for kind: run
	// SharedBuildHash fingerprints the resolved top-level build definition
	// without duplicating it into each service's public config shape.
	SharedBuildHash string `yaml:"-" json:"-"`

	// Basic settings
	Port int `yaml:"port,omitempty" json:"port,omitempty"`
	// Ports publishes raw TCP/UDP host ports directly on the node, bypassing
	// tako-proxy (docker-compose syntax: "PORT", "HOST:CONTAINER",
	// "IP:HOST:CONTAINER", optional "/tcp" or "/udp"). Requires the recreate
	// deploy strategy and at most one replica.
	Ports      []string          `yaml:"ports,omitempty" json:"ports,omitempty"`
	Command    StringOrList      `yaml:"command,omitempty" json:"command,omitempty,omitzero"`
	Entrypoint StringOrList      `yaml:"entrypoint,omitempty" json:"entrypoint,omitempty,omitzero"`
	Labels     map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`
	Replicas   int               `yaml:"replicas,omitempty" json:"replicas,omitempty"` // Default: 1
	Restart    string            `yaml:"restart,omitempty" json:"restart,omitempty"`   // Docker restart policy (always, unless-stopped, on-failure, no)
	Env        map[string]string `yaml:"env,omitempty" json:"env,omitempty"`
	EnvFile    string            `yaml:"envFile,omitempty" json:"envFile,omitempty"` // Legacy single .env file path
	EnvFiles   []string          `yaml:"envFiles,omitempty" json:"envFiles,omitempty"`
	// RunInputHash is an internal digest of the fully resolved env/secret file
	// used to fingerprint kind:run executions without persisting secret values.
	RunInputHash    string                  `yaml:"-" json:"-"`
	User            string                  `yaml:"user,omitempty" json:"user,omitempty"`
	WorkingDir      string                  `yaml:"workingDir,omitempty" json:"workingDir,omitempty"`
	StopGracePeriod string                  `yaml:"stopGracePeriod,omitempty" json:"stopGracePeriod,omitempty"`
	Init            bool                    `yaml:"init,omitempty" json:"init,omitempty"`
	ExtraHosts      []string                `yaml:"extraHosts,omitempty" json:"extraHosts,omitempty"`
	Ulimits         map[string]UlimitConfig `yaml:"ulimits,omitempty" json:"ulimits,omitempty"`
	ShmSize         string                  `yaml:"shmSize,omitempty" json:"shmSize,omitempty"`

	// Secrets: ["DATABASE_URL", "JWT_SECRET"] or ["VAR_NAME:SECRET_KEY"].
	Secrets []string            `yaml:"secrets,omitempty" json:"secrets,omitempty"` // Tako secrets from .tako/secrets files
	Volumes []string            `yaml:"volumes,omitempty" json:"volumes,omitempty"`
	Files   []ServiceFileConfig `yaml:"files,omitempty" json:"files,omitempty"`
	// FilesContentHash is an internal digest of fully resolved operator file
	// metadata and bytes; file contents never enter desired state or labels.
	FilesContentHash string `yaml:"-" json:"-"`

	// Service type flags
	Persistent bool `yaml:"persistent,omitempty" json:"persistent,omitempty"` // Don't remove on redeploy (databases, caches)

	// Per-service proxy settings (if present, service is exposed publicly)
	Proxy *ProxyConfig `yaml:"proxy,omitempty" json:"proxy,omitempty"`

	// Load balancing (for multi-replica services)
	LoadBalancer LoadBalancerConfig `yaml:"loadBalancer,omitempty" json:"loadBalancer,omitempty"`

	// Health checks
	HealthCheck HealthCheckConfig `yaml:"healthCheck,omitempty" json:"healthCheck,omitempty"`

	// Deployment strategy
	Deploy DeployConfig `yaml:"deploy,omitempty" json:"deploy,omitempty"`

	// Per-service backup
	Backup *BackupConfig `yaml:"backup,omitempty" json:"backup,omitempty"`

	// Per-service monitoring
	Monitoring *MonitoringConfig `yaml:"monitoring,omitempty" json:"monitoring,omitempty"`

	// Container resource limits.
	Resources *ResourceLimitsConfig `yaml:"resources,omitempty" json:"resources,omitempty"`

	// Cross-project networking
	Export  bool     `yaml:"export,omitempty" json:"export,omitempty"`   // Attach this service to a service-scoped export network
	Imports []string `yaml:"imports,omitempty" json:"imports,omitempty"` // Import same-environment services from other projects (format: "project.service")

	// Placement configuration for takod scheduling.
	Placement *PlacementConfig `yaml:"placement,omitempty" json:"placement,omitempty"` // Where to run service replicas

	// Service dependencies (controls deployment order)
	DependsOn []string `yaml:"dependsOn,omitempty" json:"dependsOn,omitempty"` // List of service names this service depends on

	// ReuseFiles tells rollback paths to mount an already-published immutable
	// FilesContentHash instead of reading today's local sources.
	ReuseFiles bool `yaml:"-" json:"-"`
	// contains filtered or unexported fields
}

type ServiceFileConfig struct {
	Source string `yaml:"source" json:"source"`
	Target string `yaml:"target" json:"target"`
	Secret bool   `yaml:"secret,omitempty" json:"secret,omitempty"`
	Owner  string `yaml:"owner,omitempty" json:"owner,omitempty"`
}

type SharedBuildConfig struct {
	Context    string            `yaml:"context" json:"context"`
	Args       map[string]string `yaml:"args,omitempty" json:"args,omitempty"`
	Target     string            `yaml:"target,omitempty" json:"target,omitempty"`
	Dockerfile string            `yaml:"dockerfile,omitempty" json:"dockerfile,omitempty"`
	// contains filtered or unexported fields
}

type StateConfig struct {
	Backend            string `yaml:"backend,omitempty" json:"backend,omitempty"`                       // replicated
	DeployConsistency  string `yaml:"deployConsistency,omitempty" json:"deployConsistency,omitempty"`   // lease
	OnUnreachableNode  string `yaml:"onUnreachableNode,omitempty" json:"onUnreachableNode,omitempty"`   // block
	RemoteCacheEnabled *bool  `yaml:"remoteCacheEnabled,omitempty" json:"remoteCacheEnabled,omitempty"` // must be true
}

type StringOrList struct {
	// contains filtered or unexported fields
}

type TLSConfig struct {
	Mode      string `yaml:"mode,omitempty" json:"mode,omitempty"`         // auto, off
	Provider  string `yaml:"provider,omitempty" json:"provider,omitempty"` // letsencrypt, zerossl (default: letsencrypt)
	Staging   bool   `yaml:"staging,omitempty" json:"staging,omitempty"`
	Challenge string `yaml:"challenge,omitempty" json:"challenge,omitempty"` // auto, dns
}

type UlimitConfig struct {
	Soft int64 `yaml:"soft" json:"soft"`
	Hard int64 `yaml:"hard" json:"hard"`
}

type ValidationWarning struct {
	Environment string
	Service     string
	Field       string
	Message     string
}

type VolumeConfig struct {
	Driver     string            `yaml:"driver,omitempty" json:"driver,omitempty"`           // Volume driver (default: "local")
	DriverOpts map[string]string `yaml:"driver_opts,omitempty" json:"driver_opts,omitempty"` // Driver-specific options
	Labels     map[string]string `yaml:"labels,omitempty" json:"labels,omitempty"`           // Volume labels
	External   bool              `yaml:"external,omitempty" json:"external,omitempty"`       // If true, volume must already exist
	Name       string            `yaml:"name,omitempty" json:"name,omitempty"`               // Override the auto-generated name (opt-out of prefix)
}