import type { ISystemSecretOwner, TSecretManagementScope } from './secret.js';

export interface ICloudlyS3BackupTargetDescriptor {
  type: 's3';
  endpoint: string;
  bucket: string;
  region?: string;
  port?: number;
  useSsl?: boolean;
}

export interface ICloudlyNfsBackupTargetDescriptor {
  type: 'nfs';
  path: string;
}

export interface ICloudlySmbBackupTargetDescriptor {
  type: 'smb';
  host: string;
  share: string;
  domain?: string;
  port?: number;
}

export type TCloudlyBackupTargetDescriptor =
  | ICloudlyS3BackupTargetDescriptor
  | ICloudlyNfsBackupTargetDescriptor
  | ICloudlySmbBackupTargetDescriptor;

/** Public runtime-configurable settings. No serialized credential belongs here. */
export interface ICloudlySettings {
  deploymentArchiveRetentionDays?: number;
  backupExternalTarget?: TCloudlyBackupTargetDescriptor;
  backupNodeCacheKeepDays?: number;
  dcrouterGatewayUrl?: string;
  dcrouterGatewayClientId?: string;
  dcrouterTargetHost?: string;
  dcrouterTargetPort?: number;
  dcrouterTargetHostsByNode?: Record<string, string>;
  dcrouterMailSubmissionHost?: string;
  dcrouterMailSubmissionPort?: number;
  dcrouterMailSubmissionTlsMode?: 'plain' | 'starttls' | 'implicitTls';
  dcrouterMailForwardTargetHost?: string;
  dcrouterMailForwardTargetHostsByNode?: Record<string, string>;
  corebuildWorkerUrl?: string;
  corebuildWorkerUrls?: string[];
}

export const cloudlySystemSecretOwner = Object.freeze({
  kind: 'system',
  systemId: 'cloudly-settings',
} as const satisfies ISystemSecretOwner);

export const cloudlySystemSecretManagementScope =
  'system:cloudly-settings' as const satisfies TSecretManagementScope;

/** Stable keys for values removed from serialized Cloudly settings. */
export const cloudlySystemSecretKeys = Object.freeze({
  hetznerToken: 'HETZNER_TOKEN',
  cloudflareToken: 'CLOUDFLARE_TOKEN',
  backupExternalTargetCredentials: 'BACKUP_EXTERNAL_TARGET_CREDENTIALS',
  dcrouterGatewayApiToken: 'DCROUTER_GATEWAY_API_TOKEN',
  baseosJoinToken: 'BASEOS_JOIN_TOKEN',
  corebuildWorkerToken: 'COREBUILD_WORKER_TOKEN',
  corebuildWorkers: 'COREBUILD_WORKERS',
  awsAccessKey: 'AWS_ACCESS_KEY',
  awsSecretKey: 'AWS_SECRET_KEY',
  awsRegion: 'AWS_REGION',
  digitalOceanToken: 'DIGITALOCEAN_TOKEN',
  azureClientId: 'AZURE_CLIENT_ID',
  azureClientSecret: 'AZURE_CLIENT_SECRET',
  azureTenantId: 'AZURE_TENANT_ID',
  azureSubscriptionId: 'AZURE_SUBSCRIPTION_ID',
  googleCloudKey: 'GOOGLE_CLOUD_KEY',
  googleCloudProjectId: 'GOOGLE_CLOUD_PROJECT_ID',
  vultrApiKey: 'VULTR_API_KEY',
  linodeToken: 'LINODE_TOKEN',
  ovhApplicationKey: 'OVH_APPLICATION_KEY',
  ovhApplicationSecret: 'OVH_APPLICATION_SECRET',
  ovhConsumerKey: 'OVH_CONSUMER_KEY',
  scalewayAccessKey: 'SCALEWAY_ACCESS_KEY',
  scalewaySecretKey: 'SCALEWAY_SECRET_KEY',
  scalewayOrganizationId: 'SCALEWAY_ORGANIZATION_ID',
} as const);