v1beta1

type BackupConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BackupConfigSpec   `json:"spec,omitempty"`
	Status BackupConfigStatus `json:"status,omitempty"`
}

type BackupConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BackupConfig `json:"items"`
}

type BackupConfigSpec struct {
	// How many goroutines to use during backup && wal downloading. Default value is evaluated at runtime
	DownloadConcurrency *int `json:"downloadConcurrency,omitempty"`

	// Disk read rate limit during backup creation in bytes per second. Default value is evaluated at runtime
	UploadDiskRateLimit *int `json:"uploadDiskRateLimitBytesPerSecond,omitempty"`

	// Network upload rate limit during backup uploading in bytes per second. Default value is evaluated at runtime
	UploadNetworkRateLimit *int `json:"uploadNetworkRateLimitBytesPerSecond,omitempty"`

	// How many concurrency streams to use during backup uploading. Default value is evaluated at runtime
	UploadConcurrency *int `json:"uploadConcurrency,omitempty"`

	// How many concurrency streams are reading disk during backup uploading. Default value is evaluated at runtime
	UploadDiskConcurrency *int `json:"uploadDiskConcurrency,omitempty"`

	// How many times failed file will be retried during backup / wal download. Default: 15.
	DownloadFileRetries int `json:"downloadFileRetries,omitempty"`

	// Determines how many delta backups can be between full backups. Defaults to 0.
	DeltaMaxSteps int `json:"deltaMaxSteps,omitempty"`

	// Disable calling fsync after writing files when extracting tar files. Default: false.
	TarDisableFsync bool `json:"tarDisableFsync,omitempty"`

	// Threshold in bytes is size of one backup bundle. Default: 1073741823.
	TarSizeThreshold *int64 `json:"tarSizeThreshold,omitempty"`

	// Backups retention configuration
	Retention BackupRetentionConfig `json:"retention,omitempty"`

	// Backups storage configuration
	Storage StorageConfig `json:"storage"`

	// Resources for wal-g sidecar configurations
	//
	// IMPORTANT: resource changes will NOT trigger auto-update on clusters
	// Manual rollout with pods recreation needed instead
	Resources corev1.ResourceRequirements `json:"resources,omitempty"`

	// Backups encryption configuration
	Encryption BackupEncryptionConfig `json:"encryption,omitempty"`
}

type BackupConfigSpecWithSecrets struct {
	BackupConfigSpec
	Storage    StorageConfigWithSecrets           `json:"storage"`
	Encryption *BackupEncryptionConfigWithSecrets `json:"encryption,omitempty"`
}

type BackupConfigStatus struct {
}

type BackupConfigWithSecrets struct {
	BackupConfig
	Spec BackupConfigSpecWithSecrets `json:"spec,omitempty"`
}

type BackupEncryptionConfig struct {
	// Method used for backup encryption.
	// Currently "libsodium" method supported only.
	// Use "none" or leave empty to disable encryption.
	Method string `json:"method,omitempty"`

	// Name of the existing secret with entryption keys.
	//
	// If empty / not provided - secret will be generated automatically
	// with name "<backupconfig-name>-encryption" and random key
	//
	// For "libsodium" method secret should contain single key "libsodiumKey"
	// containing hex-encoded 32-bytes length key i.e. created with `openssl rand -hex 32`
	ExistingEncryptionSecretName string `json:"encryptionSecret,omitempty"`
}

type BackupEncryptionConfigWithSecrets struct {
	BackupEncryptionConfig
	EncryptionKeyData string
}

type BackupRetentionConfig struct {
	// Whether to disable S3 storage cleanup on BackupConfig deletion.
	// Useful when managing storage retention by S3 lifecycle policies.
	// When true, the operator will skip storage cleanup when BackupConfig is deleted.
	// +kubebuilder:default:=false
	// +optional
	IgnoreForBackupConfigDeletion bool `json:"ignoreForBackupConfigDeletion,omitempty"`

	// Whether to disable S3 storage cleanup on individual Backup resource deletion.
	// Useful when managing storage retention by S3 lifecycle policies.
	// When true, the operator will skip storage cleanup when individual Backup resources are deleted.
	// +kubebuilder:default:=false
	// +optional
	IgnoreForBackupDeletion bool `json:"ignoreForBackupDeletion,omitempty"`

	// Whether to ignore manually created backups in retention policy
	//
	// IMPORTANT: Automatically created backups should have OwnerReference with
	// ScheduledBackup or Cluster resource to be treated as auto backups!
	// (.spec.backupOwnerReference: "self" or "cluster" in ScheduledBackup resource)
	// +kubebuilder:default:=false
	// +optional
	IgnoreForManualBackups bool `json:"ignoreForManualBackups,omitempty"`

	// Minimal number of full backups to keep, this will keep backups
	// even if backup should be deleted due to DeleteBackupsAfter policy
	// Default is 5 backups
	// +kubebuilder:default:=5
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=99
	// +optional
	MinBackupsToKeep int `json:"minBackupsToKeep,omitempty"`

	// DeleteBackupsAfter is the retention policy to be used for backups
	// and WALs (i.e. '60d'). It is expressed in the form
	// of `XXu` where `XX` is a positive integer and `u` is in `[dwmh]` -
	// days, weeks, months, hours (i.e. '7d', '4w', '1m', '6h').
	// Different units should not be used at the same time
	// If not specified - backups will not be deleted automatically
	// +kubebuilder:validation:Pattern=^[1-9][0-9]*[dwmh]$
	// +optional
	DeleteBackupsAfter string `json:"deleteBackupsAfter,omitempty"`
}

type BackupType string

type CustomCAReference struct {
	// Kind of the resource containing the CA certificate
	// Can be either "ConfigMap" or "Secret"
	// +kubebuilder:validation:Enum=ConfigMap;Secret
	Kind string `json:"kind"`

	// Name of the ConfigMap or Secret containing the CA certificate
	Name string `json:"name"`

	// Key in the ConfigMap or Secret containing the CA certificate
	Key string `json:"key"`
}

type S3StorageConfig struct {
	// e.g. s3://bucket/path/to/folder
	// Mutually exclusive with PrefixFrom
	Prefix string `json:"prefix,omitempty"`

	// Reference to get prefix value from Secret or ConfigMap
	// Mutually exclusive with Prefix
	// +optional
	PrefixFrom *ValueFromSource `json:"prefixFrom,omitempty"`

	// S3 Region
	// Mutually exclusive with RegionFrom
	Region string `json:"region,omitempty"`

	// Reference to get region value from Secret or ConfigMap
	// Mutually exclusive with Region
	// +optional
	RegionFrom *ValueFromSource `json:"regionFrom,omitempty"`

	// S3 endpoint url
	// Mutually exclusive with EndpointURLFrom
	EndpointURL string `json:"endpointUrl,omitempty"`

	// Reference to get endpoint URL value from Secret or ConfigMap
	// Mutually exclusive with EndpointURL
	// +optional
	EndpointURLFrom *ValueFromSource `json:"endpointUrlFrom,omitempty"`

	// To enable path-style addressing (i.e., http://s3.amazonaws.com/BUCKET/KEY)
	// when connecting to an S3-compatible service that lack of support for
	// sub-domain style bucket URLs (i.e., http://BUCKET.s3.amazonaws.com/KEY)
	ForcePathStyle bool `json:"forcePathStyle,omitempty"`

	// S3 storage class used for backup files.
	// Default is "STANDARD". Other supported values include
	// "STANDARD_IA" for Infrequent Access and
	// "REDUCED_REDUNDANCY" for Reduced Redundancy.
	StorageClass string `json:"storageClass,omitempty"`

	// Custom CA certificate reference for S3 endpoint
	// Can be specified in either ConfigMap or Secret
	CustomCA *CustomCAReference `json:"customCA,omitempty"`

	AccessKeyIDRef     *corev1.SecretKeySelector `json:"accessKeyId,omitempty"`
	AccessKeySecretRef *corev1.SecretKeySelector `json:"accessKeySecret,omitempty"`
}

type S3StorageConfigWithSecrets struct {
	S3StorageConfig
	AccessKeyID     string
	AccessKeySecret string
	CACertData      string // Custom CA certificate data for S3 endpoint
	// Resolved values from references
	ResolvedPrefix      string // Resolved value from Prefix or PrefixFrom
	ResolvedRegion      string // Resolved value from Region or RegionFrom
	ResolvedEndpointURL string // Resolved value from EndpointURL or EndpointURLFrom
}

type StorageConfig struct {
	StorageType StorageType      `json:"type"`         // Type of storage to use, currently supported "s3" only
	S3          *S3StorageConfig `json:"s3,omitempty"` // S3-specific parameters
}

type StorageConfigWithSecrets struct {
	StorageConfig
	S3 *S3StorageConfigWithSecrets `json:"s3,omitempty"` // S3-specific parameters
}

type StorageType string

type ValueFromSource struct {
	// Reference to a key in a Secret
	// +optional
	SecretKeyRef *corev1.SecretKeySelector `json:"secretKeyRef,omitempty"`

	// Reference to a key in a ConfigMap
	// +optional
	ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"`
}