<?php

use App\Provisioning\Steps\Customer;
use App\Provisioning\Steps\Host;

$wgSubnet = env('CLUPILOT_WG_SUBNET', '10.66.0.0/24');
[$wgNetwork, $wgBits] = array_pad(explode('/', $wgSubnet), 2, '24');
$wgBase = ip2long($wgNetwork) & (0xFFFFFFFF << (32 - (int) $wgBits)) & 0xFFFFFFFF;
$wgHubDefault = long2ip($wgBase + 1); // first usable address in the CIDR

return [
    /*
    | Ordered step classes per pipeline. ::class is textual — listing steps that
    | are built incrementally does not autoload them until the pipeline runs.
    */
    'pipelines' => [
        'host' => [
            Host\ValidateHostInput::class,
            Host\EstablishSshTrust::class,
            Host\PrepareBaseSystem::class,
            Host\ConfigureWireguard::class,
            Host\InstallProxmoxVe::class,
            Host\RebootIntoPveKernel::class,
            Host\ConfigureProxmox::class,
            Host\CreateAutomationToken::class,
            Host\VerifyProxmoxApi::class,
            Host\RegisterCapacity::class,
            Host\CompleteHostOnboarding::class,
        ],
        'customer' => [
            Customer\ValidateOrder::class,
            Customer\ReserveResources::class,
            Customer\CloneVirtualMachine::class,
            Customer\ConfigureCloudInit::class,
            Customer\StartVirtualMachine::class,
            Customer\WaitForGuestAgent::class,
            Customer\ConfigureNetwork::class,
            Customer\DeployApplicationStack::class,
            Customer\ConfigureNextcloud::class,
            Customer\CreateCustomerAdmin::class,
            Customer\ConfigureDnsAndTls::class,
            Customer\RegisterBackup::class,
            Customer\RegisterMonitoring::class,
            Customer\RunAcceptanceChecks::class,
            Customer\CompleteProvisioning::class,
        ],
    ],

    // Plan → resource sizing + Nextcloud blueprint template VMID (per DC/version).
    'plans' => [
        'start' => ['quota_gb' => 100, 'disk_gb' => 120, 'ram_mb' => 4096, 'cores' => 2, 'template_vmid' => 9000],
        'team' => ['quota_gb' => 500, 'disk_gb' => 540, 'ram_mb' => 8192, 'cores' => 4, 'template_vmid' => 9000],
        'business' => ['quota_gb' => 1000, 'disk_gb' => 1050, 'ram_mb' => 16384, 'cores' => 8, 'template_vmid' => 9000],
        'enterprise' => ['quota_gb' => 2000, 'disk_gb' => 2100, 'ram_mb' => 32768, 'cores' => 16, 'template_vmid' => 9000],
    ],

    'dns' => [
        'provider' => 'hetzner',
        'token' => env('HETZNER_DNS_TOKEN', ''),
        'zone' => env('CLUPILOT_DNS_ZONE', 'clupilot.com'),
    ],

    'traefik' => [
        'dynamic_path' => env('TRAEFIK_DYNAMIC_PATH', '/etc/traefik/dynamic'),
    ],

    // CluPilot VM acts as the WireGuard hub; hosts join it during onboarding.
    'wireguard' => [
        'subnet' => $wgSubnet,
        'hub_ip' => env('CLUPILOT_WG_HUB_IP', $wgHubDefault), // handshake target
        'endpoint' => env('CLUPILOT_WG_ENDPOINT', ''),        // host:port reachable by peers
        'hub_public_key' => env('CLUPILOT_WG_HUB_PUBKEY', ''),
        'config_path' => env('CLUPILOT_WG_CONFIG_PATH', '/etc/wireguard/wg0.conf'),
    ],

    // SSH identity CluPilot deploys to each host after first password login.
    'ssh' => [
        'public_key' => env('CLUPILOT_SSH_PUBLIC_KEY', ''),
        'private_key' => env('CLUPILOT_SSH_PRIVATE_KEY', ''),
        // Per-command SSH timeout; below the job timeout (2100s) but far above
        // the phpseclib ~10s default so apt full-upgrade etc. can finish.
        'command_timeout' => (int) env('CLUPILOT_SSH_COMMAND_TIMEOUT', 2000),
    ],

    // Proxmox automation role/user created on each host.
    'proxmox' => [
        'role_id' => 'CluPilotAutomation',
        'role_privs' => 'VM.Allocate,VM.Clone,VM.Config.Disk,VM.Config.CPU,VM.Config.Memory,VM.Config.Network,VM.Config.Options,VM.Config.Cloudinit,VM.PowerMgmt,VM.Monitor,VM.Audit,VM.GuestAgent.Audit,VM.GuestAgent.Unrestricted,Datastore.AllocateSpace,Datastore.Audit,Sys.Audit',
        'user' => 'automation@pve',
        'token_name' => 'clupilot',
    ],
];