v1alpha1

type Dataplane struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty"`

	// Spec defines the behavior of a Dataplane resource.
	Spec DataplaneSpec `json:"spec,omitempty"`
}

type DataplaneList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty"`

	// List of services.
	Items []Dataplane `json:"items"`
}

type DataplaneSpec struct {

	// Number of desired pods. This is a pointer to distinguish between explicit zero and not
	// specified. Defaults to 1.
	//
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`

	// Container image name.
	//
	// +optional
	Image string `json:"image,omitempty"`

	// Image pull policy. One of Always, Never, IfNotPresent.
	//
	// +optional
	ImagePullPolicy *corev1.PullPolicy `json:"imagePullPolicy,omitempty"`

	// Entrypoint array. Defaults: "stunnerd".
	//
	// +optional
	Command []string `json:"command,omitempty"`

	// Arguments to the entrypoint.
	//
	// +optional
	Args []string `json:"args,omitempty"`

	// List of environment variables to set in the stunnerd container.
	//
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// Resources required by stunnerd.
	//
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// Optional duration in seconds the stunnerd needs to terminate gracefully. Defaults to 3600 seconds.
	//
	// +optional
	TerminationGracePeriodSeconds *int64 `json:"terminationGracePeriodSeconds,omitempty"`

	// Host networking requested for the stunnerd pod to use the host's network namespace.
	// Can be used to implement public TURN servers with Kubernetes.  Defaults to false.
	//
	// +optional
	HostNetwork bool `json:"hostNetwork,omitempty"`

	// Scheduling constraints.
	//
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`

	// SecurityContext holds pod-level security attributes and common container settings.
	//
	// +optional
	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`

	// If specified, the pod's tolerations.
	//
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`

	// If specified, the health-check port.
	//
	// +optional
	HealthCheckPort *int `json:"healthCheckPort,omitempty"`
}

type GatewayConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec GatewayConfigSpec `json:"spec,omitempty"`
}

type GatewayConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GatewayConfig `json:"items"`
}

type GatewayConfigSpec struct {
	// StunnerConfig specifies the name of the ConfigMap into which the operator renders the
	// stunnerd configfile.
	//
	// +optional
	// +kubebuilder:validation:MaxLength=64
	// +kubebuilder:validation:Pattern=`^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$`
	// +kubebuilder:default:="stunnerd-config"
	StunnerConfig *string `json:"stunnerConfig,omitempty"`

	// Realm defines the STUN/TURN authentication realm to be used for clients toauthenticate
	// with STUNner.
	//
	// The realm must consist of lower case alphanumeric characters or '-', and must start and
	// end with an alphanumeric character. No other punctuation is allowed.
	//
	// +optional
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	// +kubebuilder:default:="stunner.l7mp.io"
	Realm *string `json:"realm,omitempty"`

	// MetricsEndpoint is the URI in the form `http://address:port/path` exposed for metric
	// scraping (Prometheus). The scheme (`http://`) is mandatory. Default is to expose no
	// metric endpoint.
	//
	// +optional
	MetricsEndpoint *string `json:"metricsEndpoint,omitempty"`

	// HealthCheckEndpoint is the URI of the form `http://address:port` exposed for external
	// HTTP health-checking. A liveness probe responder will be exposed on path `/live` and
	// readiness probe on path `/ready`. The scheme (`http://`) is mandatory, default is to
	// enable health-checking at "http://0.0.0.0:8086".
	//
	// +optional
	HealthCheckEndpoint *string `json:"healthCheckEndpoint,omitempty"`

	// AuthType is the type of the STUN/TURN authentication mechanism.
	//
	// +optional
	// +kubebuilder:validation:Pattern=`^plaintext|static|longterm|ephemeral|timewindowed$`
	// +kubebuilder:default:="plaintext"
	AuthType *string `json:"authType,omitempty"`

	// Username defines the `username` credential for "plaintext" authentication.
	//
	// +optional
	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$`
	Username *string `json:"userName,omitempty"`

	// Password defines the `password` credential for "plaintext" authentication.
	//
	// +optional
	// +kubebuilder:validation:Pattern=`^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$`
	Password *string `json:"password,omitempty"`

	// SharedSecret defines the shared secret to be used for "longterm" authentication.
	//
	// +optional
	SharedSecret *string `json:"sharedSecret,omitempty"`

	// AuthLifetime defines the lifetime of "longterm" authentication credentials in seconds.
	//
	// +optional
	AuthLifetime *int32 `json:"authLifetime,omitempty"`

	// Note that externally set credentials override any inline auth credentials (AuthType,
	// AuthUsername, etc.): if AuthRef is nonempty then it is expected that the referenced
	// Secret exists and *all* authentication credentials are correctly set in the referenced
	// Secret (username/password or shared secret). Mixing of credential sources
	// (inline/external) is not supported.
	//
	// +optional
	AuthRef *gwapiv1.SecretObjectReference `json:"authRef,omitempty"`

	// LoadBalancerServiceAnnotations is a list of annotations that will go into the
	// LoadBalancer services created automatically by the operator to wrap Gateways.
	//
	// NOTE: removing annotations from a GatewayConfig will not result in the removal of the
	// corresponding annotations from the LoadBalancer service, in order to prevent the
	// accidental removal of an annotation installed there by Kubernetes or the cloud
	// provider. If you really want to remove an annotation, do this manually or simply remove
	// all Gateways (which will remove the corresponding LoadBalancer services), update the
	// GatewayConfig and then recreate the Gateways, so that the newly created LoadBalancer
	// services will contain the required annotations.
	//
	// +optional
	LoadBalancerServiceAnnotations map[string]string `json:"loadBalancerServiceAnnotations,omitempty"`

	// LogLevel specifies the default loglevel for the STUNner daemon.
	//
	// +optional
	LogLevel *string `json:"logLevel,omitempty"`

	// MinRelayPort is the smallest relay port assigned for STUNner relay connections.
	//
	// +optional
	// +kubebuilder:validation:Minimum:1
	// +kubebuilder:validation:Maximum:65535
	MinPort *int32 `json:"minPort,omitempty"`

	// MaxRelayPort is the smallest relay port assigned for STUNner relay connections.
	//
	// +kubebuilder:validation:Minimum:1
	// +kubebuilder:validation:Maximum:65535
	MaxPort *int32 `json:"maxPort,omitempty"`

	// Dataplane defines the TURN server to set up for the STUNner Gateways using this
	// GatewayConfig. Can be used to select the stunnerd image repo and version or deploy into
	// the host-network namespace.
	//
	// +optional
	// +kubebuilder:default:="default"
	Dataplane *string `json:"dataplane,omitempty"`
}

type StaticService struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Spec defines the behavior of a service.
	Spec StaticServiceSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}

type StaticServiceList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// List of services.
	Items []StaticService `json:"items"`
}

type StaticServiceSpec struct {
	// The list of ports reachable via this service (currently omitted).
	// +patchMergeKey=port
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=port
	// +listMapKey=protocol
	// +optional
	Ports []corev1.ServicePort `json:"ports,omitempty" patchStrategy:"merge" patchMergeKey:"port" protobuf:"bytes,1,rep,name=ports"`

	// Prefixes is a list of IP address prefixes reachable via this route.
	Prefixes []string `json:"prefixes"`
}