v1alpha1

type Auth struct {
	// Secret specifies a secret which will be used for jwt signatures.
	Secret string `json:"secret,omitempty"`

	// CertificateFile specifies a path to a PEM encoded certificate file which
	// will be used for validating jwt signatures.
	CertificateFile string `json:"certificateFile,omitempty"`

	// CertificateKeyFile specifies a path to a PEM encoded certificate key
	// which will be used for jwt signatures.
	CertificateKeyFile string `json:"certificateKeyFile,omitempty"`

	// DisablePasswords disables password authentication. This makes sense if
	// you want to require SSO, as login method.
	DisablePasswords bool `json:"disablePasswords,omitempty"`

	// SSO specifies single sign on configuration.
	SSO SSO `json:"sso,omitempty"`

	// AllowRegister specifies if users are allowed to register new accounts.
	AllowRegister bool `json:"allowRegister,omitempty"`

	// IsVerified specifies if users are required to verify their email address.
	RequireVerification bool `json:"requireVerification,omitempty"`

	// SendWelcomeEmail specifies if a welcome email should be sent to new users.
	// This will use the default email config
	SendWelcomeEmail bool `json:"sendWelcomeEmail,omitempty"`
}

type CapsuleMatch struct {
	// If set, only capsules in one of the namespaces given will have this step run.
	Namespaces []string `json:"namespaces,omitempty"`
	// If set, only execute the plugin on the capsules specified.
	Names []string `json:"names,omitempty"`
	// If set, only execute the plugin on the capsules matching the annotations.
	Annotations map[string]string `json:"annotations,omitempty"`
	// If set, will enable the step for the Rig platform which is a Capsule as well
	EnableForPlatform bool `json:"enableForPlatform,omitempty"`
}

type CapsuleStep struct {
	// The plugin to use for handling the capsule step.
	// fx. "rigdev.ingress_routes" for routesStep will create an ingress resource per route.
	// fx. "rigdev.deployment" for deploymentStep will use the default deployment plugin.
	Plugin string `json:"plugin,omitempty"`

	// Config is a string defining the plugin-specific configuration of the plugin.
	Config string `json:"config,omitempty"`
}

type Client struct {
	// Postgres holds configuration for the postgres client.
	Postgres ClientPostgres `json:"postgres,omitempty"`

	// Docker sets the host for the Docker client.
	Docker ClientDocker `json:"docker,omitempty"`

	// Deprecated: use 'client.mailjets' instead.
	// Mailjet sets the API key and secret for the Mailjet client.
	Mailjet ClientMailjet `json:"mailjet,omitempty"`

	// Mailjets holds configuration for multiple mailjet clients.
	// The key is the id of the client, which should be unique across Mailjet and SMTP clients.
	Mailjets map[string]ClientMailjet `json:"mailjets,omitempty"`

	// Deprecated: use 'client.smtps' instead.
	// SMTP sets the host, port, username and password for the SMTP client.
	SMTP ClientSMTP `json:"smtp,omitempty"`

	// SMTPs holds configuration for muliple SMTP clients.
	// The key is the id of the client, which should be unique across Mailjet and SMTP clients.
	SMTPs map[string]ClientSMTP `json:"smtps,omitempty"`

	// Operator sets the base url for the Operator client.
	Operator ClientOperator `json:"operator,omitempty"`

	// Slack holds configuration for sending slack messages. The key is the id of the client.
	// For example the workspace in which the app is installed
	Slack map[string]ClientSlack `json:"slack,omitempty"`

	// Git client configuration for communicating with multiple repositories.
	Git ClientGit `json:"git,omitempty"`
}

type ClientDocker struct {
	// Host where the docker daemon can be reached.
	Host string `json:"host,omitempty"`
}

type ClientGit struct {
	// Auths the git client can behave as.
	Auths []GitAuth `json:"auths,omitempty"`

	// Author used when creating commits.
	Author GitAuthor `json:"author,omitempty"`
}

type ClientMailjet struct {
	// APIKey is the mailjet API key
	APIKey string `json:"apiKey,omitempty"`

	// SecretKey is the mailjet secret key
	SecretKey string `json:"secretKey,omitempty"`
}

type ClientOperator struct {
	// BaseURL is the URL used to connect to the operator API
	BaseURL string `json:"baseUrl,omitempty"`
}

type ClientPostgres struct {
	// User is the database user used when connecting to the postgres database.
	User string `json:"user,omitempty"`

	// Password is the password used when connecting to the postgres database.
	Password string `json:"password,omitempty"`

	// Host is the host where the postgres database can be reached.
	Host string `json:"host,omitempty"`

	// Port is the port of the postgres database server.
	Port int `json:"port,omitempty"`

	// Database in the postgres server to use
	Database string `json:"database,omitempty"`

	// Insecure is wether to use SSL when connecting to the postgres server
	Insecure bool `json:"insecure,omitempty"`
}

type ClientSMTP struct {
	// Host is the SMTP server host.
	Host string `json:"host,omitempty"`

	// Port is the SMTP server port to use.
	Port int `json:"port,omitempty"`

	// Username used when connecting to the SMTP server.
	Username string `json:"username,omitempty"`

	// Password used when connecting to the SMTP server.
	Password string `json:"password,omitempty"`
}

type ClientSlack struct {
	// Slack authentication token.
	Token string `json:"token,omitempty"`
}

type Cluster struct {
	// URL to communicate to the cluster. If set, a Token and CertificateAuthority should
	// be provided as well.
	// If not set, the cluster is interpreted to be the cluster in which the platform runs.
	URL string `json:"url,omitempty"`

	// Token for communicating with the cluster. Available through a service-account's secret.
	Token string `json:"token,omitempty"`

	// Certificate authority for communicating with the cluster. Available through a service-account's secret.
	CertificateAuthority string `json:"certificateAuthority,omitempty"`

	// Type of the cluster - either `docker` or `k8s`.
	Type ClusterType `json:"type,omitempty"`

	// DevRegistry configuration
	DevRegistry DevRegistry `json:"devRegistry,omitempty"`

	// Git sets up gitops write back for this cluster.
	Git ClusterGit `json:"git,omitempty"`

	// If set, secrets will be created if needed, for pulling images.
	CreatePullSecrets *bool `json:"createPullSecrets,omitempty"`
}

type ClusterGit struct {
	// URL is the git repository URL.
	URL string `json:"url,omitempty"`

	// Branch to commit changes to.
	Branch string `json:"branch,omitempty"`

	// PathPrefix path to commit to in git repository.
	// Deprecated: Use `pathPrefixes` instead.
	PathPrefix string `json:"pathPrefix,omitempty"`

	// PathPrefixes path to commit to in git repository
	PathPrefixes PathPrefixes `json:"pathPrefixes,omitempty"`
	// Templates used for commit messages.
	Templates GitTemplates `json:"templates,omitempty"`

	// Credentials to use when connecting to git.
	// Deprecated: Use `client.git.auths` instead.
	Credentials GitCredentials `json:"credentials,omitempty"`

	// Author used when creating commits.
	// Deprecated: Use `client.git.author` instead.
	Author GitAuthor `json:"author,omitempty"`
}

type ClusterType string

type CustomPlugin struct {
	// The container image which supplies the plugins
	Image string `json:"image"`
}

type DevRegistry struct {
	// Host is the host used in image names when pushing to the registry from
	// outside of the cluster.
	Host string `json:"host,omitempty"`

	// ClusterHost is the host where the registry can be reached from within
	// the cluster. Any image which is named after `Host` will be rename to use
	// `ClusterHost` instead. This ensures that the image can be pulled from
	// within the cluster.
	ClusterHost string `json:"clusterHost,omitempty"`
}

type DockerRegistryCredentials struct {
	// Username for the docker registry.
	Username string `json:"username,omitempty"`
	// Password for the docker registry.
	Password string `json:"password,omitempty"`
	// Email for the docker registry.
	Email string `json:"email,omitempty"`
}

type Email struct {
	// ID is the specified id an email configuration.
	ID string `json:"id,omitempty"`

	// From is who is set as the sender of rig emails.
	From string `json:"from,omitempty"`

	// Deprecated: ID for an email configuration is used instead.
	Type EmailType `json:"type,omitempty"`
}

type EmailType string

type GitAuth struct {
	// URL is a exact match for the repo-url this auth can be used for.
	URL string `json:"url,omitempty"`

	// URLPrefix is a prefix-match for the repo urls this auth can be used for.
	URLPrefix string `json:"urlPrefix,omitempty"`

	// WebHookSecret is the secret used to validate incoming webhooks.
	WebHookSecret string `json:"webHookSecret,omitempty"`

	// Credentials to use when connecting to git.
	Credentials GitCredentials `json:"credentials,omitempty"`
}

type GitAuthor struct {
	// Name of author
	Name string `json:"name,omitempty"`

	// Email of author
	Email string `json:"email,omitempty"`
}

type GitCredentials struct {
	// HTTPS specifies basic auth credentials.
	HTTPS HTTPSCredential `json:"https,omitempty"`

	// SSH specifies SSH credentials.
	SSH SSHCredential `json:"ssh,omitempty"`
}

type GitTemplates struct {
	// Rollout specifies the template used for rollout commits.
	Rollout string `json:"rollout,omitempty"`

	// Delete specifies the template used for delete commits.
	Delete string `json:"delete,omitempty"`
}

type HTTPSCredential struct {
	// Username is the basic auth user name
	Username string `json:"username,omitempty"`

	// Password is the basic auth password
	Password string `json:"password,omitempty"`
}

type Logging struct {
	// DevModeEnabled enables verbose logs and changes the logging format to be
	// more human readable.
	DevMode bool `json:"devMode,omitempty"`

	// Level sets the granularity of logging.
	Level zapcore.Level `json:"level,omitempty"`
}

type OIDCProvider struct {
	// Name is a human-readable name of the provider. If set this will be used
	// instead of the provider id (the key in
	// `PlatformConfig.Auth.SSO.OIDCProviders`)
	Name string `json:"name,omitempty"`

	// IssuerURL is the URL for the OIDC issuer endpoint.
	IssuerURL string `json:"issuerURL,omitempty"`

	// ClientID is the OAuth client ID.
	ClientID string `json:"clientID,omitempty"`

	// ClientSecret is the OAuth client secret.
	ClientSecret string `json:"clientSecret,omitempty"`

	// AllowedDomains is a list of email domains to allow. If left empty any
	// successful authentication on the provider is allowed.
	AllowedDomains []string `json:"allowedDomains,omitempty"`

	// Scopes is a list of additional scopes other than `openid`, `email` and
	// `profile`.
	Scopes []string `json:"scopes"`

	// GroupsClaim is the path to a claim in the JWT containing a string or
	// list of strings of group names.
	GroupsClaim string `json:"groupsClaim,omitempty"`

	// DisableJITGroups disables creation of groups found through OIDC in rig.
	DisableJITGroups *bool `json:"disableJITGroups,omitempty"`

	// GroupMapping is a mapping from OIDC provided group names to group names
	// used in rig. If an OIDC provided group name is not provided in this
	// mapping we will use the OIDC provided groupname in rig.
	GroupMapping map[string]string `json:"groupMapping,omitempty"`

	// Icon is what icon to show for this provider.
	Icon OIDCProviderIcon `json:"icon,omitempty"`

	// DisableUserMerging disallows merging their OIDC account with an existing user in rig.
	// This effectively means, that if a user is created using OIDC, then it can only login
	// using that OIDC provider.
	DisableUserMerging *bool `json:"disableUserMerging,omitempty"`
}

type OIDCProviderIcon string

type OperatorConfig struct {
	metav1.TypeMeta `json:",inline"`

	// WebhooksEnabled sets wether or not webhooks should be enabled. When
	// enabled a certificate should be mounted at the webhook server
	// certificate path. Defaults to true if omitted.
	WebhooksEnabled *bool `json:"webhooksEnabled,omitempty"`

	// DevModeEnabled enables verbose logs and changes the logging format to be
	// more human readable.
	DevModeEnabled bool `json:"devModeEnabled,omitempty"`

	// LeaderElectionEnabled enables leader election when running multiple
	// instances of the operator.
	LeaderElectionEnabled *bool `json:"leaderElectionEnabled,omitempty"`

	// Pipeline defines the capsule controller pipeline
	Pipeline Pipeline `json:"pipeline,omitempty"`
}

type PathPrefixes struct {
	Capsule string `json:"capsule,omitempty"`
	Project string `json:"project,omitempty"`
}

type Pipeline struct {
	// How to handle the service account step of capsules in the cluster.
	// Defaults to rigdev.service_account.
	ServiceAccountStep CapsuleStep `json:"serviceAccountStep,omitempty"`
	// How to handle the deployment step of capsules in the cluster.
	// Defaults to rigdev.deployment.
	DeploymentStep CapsuleStep `json:"deploymentStep,omitempty"`
	// How to handle the routes for capsules in the cluster.
	// If left empty, routes will not be handled.
	RoutesStep CapsuleStep `json:"routesStep,omitempty"`
	// How to handle the cronjob step of capsules in the cluster.
	// Defaults to rigdev.cron_jobs
	CronJobsStep CapsuleStep `json:"cronJobsStep,omitempty"`
	// How to handle the VPA step of capsules in the cluster.
	// If left empty, no VPAs will be created.
	VPAStep CapsuleStep `json:"vpaStep,omitempty"`
	// How to handle the service monitor step of capsules in the cluster.
	// If left empty, no service monitors will be created.
	// rigdev.service_monitor plugin spawns a Prometheus ServiceMonitor per capsule
	// for use with a Prometheus Operator stack.
	ServiceMonitorStep CapsuleStep `json:"serviceMonitorStep,omitempty"`
	// Steps to perform as part of running the operator.
	// +patchStrategy=merge
	Steps []Step `json:"steps,omitempty"`
	// CustomPlugins enables custom plugins to be injected into the
	// operator. The plugins injected here can then be referenced in 'steps'
	CustomPlugins []CustomPlugin `json:"customPlugins,omitempty"`
}

type PlatformConfig struct {
	metav1.TypeMeta `json:",inline"`

	// Port sets the port the platform should listen on
	Port int `json:"port,omitempty"`

	// PublicUrl sets the public url for the platform. This is used for
	// generating urls for the platform when using oauth2.
	PublicURL string `json:"publicURL,omitempty"`

	// TelemetryEnabled specifies wether or not we are allowed to collect usage
	// data. Defaults to true.
	TelemetryEnabled bool `json:"telemetryEnabled,omitempty"`

	// Auth holds authentication configuration.
	Auth Auth `json:"auth,omitempty"`

	// Client holds configuration for clients used in the platform.
	Client Client `json:"client,omitempty"`

	// Repository specifies the type of db to use along with secret key
	Repository Repository `json:"repository,omitempty"`

	// Cluster holds cluster specific configuration
	// Deprecated: Use `clusters` instead.
	Cluster Cluster `json:"cluster,omitempty"`

	// Email holds the default configuration for sending emails. Either using mailjet or using SMTP.
	Email Email `json:"email,omitempty"`

	// Logging holds information about the granularity of logging
	Logging Logging `json:"logging,omitempty"`

	// Clusters the platform has access to.
	Clusters map[string]Cluster `json:"clusters,omitempty"`

	// DockerRegistries holds configuration for multiple docker registries. The key is the host of the registry
	DockerRegistries map[string]DockerRegistryCredentials `json:"dockerRegistries,omitempty"`
}

type Plugin struct {
	// Optional tag which is readable by plugin when executed
	Tag string `json:"tag,omitempty"`
	// Name of the plugin to run.
	Name string `json:"name,omitempty"`
	// Config is a string defining the plugin-specific configuration of the plugin.
	Config string `json:"config,omitempty"`
}

type PrometheusServiceMonitor struct {
	// Path is the path which Prometheus should query on ports. Defaults to /metrics if not set.
	Path string `json:"path,omitempty"`
	// PortName is the name of the port which Prometheus will query metrics on
	PortName string `json:"portName"`
}

type Repository struct {
	// Store is what database will be used, can only be postgres.
	Store string `json:"store,omitempty"`

	// Secret is a secret key used for encrypting sensitive data before saving
	// it in the database.
	Secret string `json:"secret,omitempty"`
}

type SSHCredential struct {
	// PrivateKey is a PEM encoded SSH private key.
	PrivateKey string `json:"privateKey,omitempty"`

	// PrivateKeyPassword is an optional password for the SSH private key.
	PrivateKeyPassword string `json:"password,omitempty"`
}

type SSO struct {
	// OIDCProviders specifies enabled OIDCProviders which can be used for
	// login.
	OIDCProviders map[string]OIDCProvider `json:"oidcProviders,omitempty"`
}

type Step struct {
	// Optional tag which is readable by plugins when executed
	Tag string `json:"tag,omitempty"`
	// Match requirements for running the Step on a given Capsule.
	Match CapsuleMatch `json:"match,omitempty"`

	// Plugins to run as part of this step.
	Plugins []Plugin `json:"plugins,omitempty"`

	// If set, only capsules in one of the namespaces given will have this step run.
	// Deprecated, use Match.Namespaces.
	Namespaces []string `json:"namespaces,omitempty"`
	// If set, only execute the plugin on the capsules specified.
	// Deprecated, use Match.CapsuleNames.
	Capsules []string `json:"capsules,omitempty"`
	// If set, will enable the step for the Rig platform which is a Capsule as well
	// Deprecated, use Match.EnableForPlatform.
	EnableForPlatform bool `json:"enableForPlatform,omitempty"`
}

type VerticalPodAutoscaler struct {
	// Enabled enables the creation of a VerticalPodAutoscaler per capsule
	Enabled bool `json:"enabled,omitempty"`
}