# The fancy-dns custom resources. Cluster-scoped definitions, namespaced
# objects. The runtime (`fancy-dns -kube`) watches them read-only.
#
# Field names are snake_case where they mirror config.yaml (allow_domains,
# max_concurrent, ...), so a group copied out of the YAML pastes in unchanged.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: dnszones.fancydns.k6n.net
spec:
  group: fancydns.k6n.net
  scope: Namespaced
  names: {kind: DNSZone, listKind: DNSZoneList, plural: dnszones, singular: dnszone, shortNames: [dnsz]}
  versions:
    - name: v1alpha1
      served: true
      storage: true
      additionalPrinterColumns:
        - {name: Zone, type: string, jsonPath: .spec.zone}
        - {name: Age, type: date, jsonPath: .metadata.creationTimestamp}
      schema:
        openAPIV3Schema:
          type: object
          required: [spec]
          properties:
            spec:
              type: object
              required: [zone]
              properties:
                zone: {type: string, minLength: 3, maxLength: 253, description: "Zone apex, e.g. home.example.com"}
                ttl: {type: integer, minimum: 1, maximum: 604800, description: "Zone $TTL and SOA minimum (seconds)"}
                soa: {type: string, maxLength: 512, description: "SOA rdata; omit to synthesise one from the apex NS"}
                records:
                  type: array
                  maxItems: 5000
                  items:
                    type: object
                    required: [name, type, value]
                    properties:
                      name: {type: string, minLength: 1, maxLength: 253, description: "Owner; @ is the apex, a name without a trailing dot is relative to the zone"}
                      type: {type: string, enum: [A, AAAA, CAA, CNAME, DHCID, HINFO, HTTPS, LOC, MX, NAPTR, NS, PTR, SRV, SPF, SSHFP, SVCB, TXT, URI]}
                      ttl: {type: integer, minimum: 1, maximum: 604800}
                      value: {type: string, minLength: 1, maxLength: 4096, description: "Presentation-format RDATA"}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: clientgroups.fancydns.k6n.net
spec:
  group: fancydns.k6n.net
  scope: Namespaced
  names: {kind: ClientGroup, listKind: ClientGroupList, plural: clientgroups, singular: clientgroup, shortNames: [cg]}
  versions:
    - name: v1alpha1
      served: true
      storage: true
      additionalPrinterColumns:
        - {name: Policy, type: string, jsonPath: .spec.policy}
        - {name: Priority, type: integer, jsonPath: .spec.priority}
        - {name: Age, type: date, jsonPath: .metadata.creationTimestamp}
      schema:
        openAPIV3Schema:
          type: object
          required: [spec]
          properties:
            spec:
              type: object
              required: [policy, match]
              properties:
                priority: {type: integer, default: 0, description: "Groups are first-match-wins; lower runs first, ties break on name. YAML groups always run before these."}
                comment: {type: string, maxLength: 512}
                policy: {type: string, enum: [allow, block_only, deny]}
                match:
                  type: object
                  properties:
                    cidrs: {type: array, items: {type: string}}
                    ptr_suffixes: {type: array, items: {type: string}}
                    tags: {type: array, items: {type: string}}
                    any: {type: boolean}
                allow_domains: {type: array, items: {type: string}}
                deny_domains: {type: array, items: {type: string}}
                skip_blocklist: {type: boolean}
                skip_cache: {type: boolean}
                rate_limit: {type: integer, minimum: 0}
                max_concurrent: {type: integer, minimum: 0}
                log_queries: {type: boolean}
                upstreams: {type: array, items: {type: string}}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: blocklists.fancydns.k6n.net
spec:
  group: fancydns.k6n.net
  scope: Namespaced
  names: {kind: BlockList, listKind: BlockListList, plural: blocklists, singular: blocklist, shortNames: [bl]}
  versions:
    - name: v1alpha1
      served: true
      storage: true
      additionalPrinterColumns:
        - {name: URL, type: string, jsonPath: .spec.url}
        - {name: Format, type: string, jsonPath: .spec.format}
        - {name: Disabled, type: boolean, jsonPath: .spec.disabled}
        - {name: Age, type: date, jsonPath: .metadata.creationTimestamp}
      schema:
        openAPIV3Schema:
          type: object
          required: [spec]
          properties:
            spec:
              type: object
              required: [url]
              properties:
                url: {type: string, pattern: '^https?://', description: "http(s) only; file paths are not accepted from the cluster"}
                format: {type: string, enum: [auto, hosts, adblock, plain, rpz]}
                mirror: {type: array, items: {type: string, pattern: '^https?://'}}
                disabled: {type: boolean}
                refresh: {type: string, description: "Go duration, e.g. 12h (default 24h)"}
                timeout: {type: string, description: "Go duration, e.g. 30s"}
                max_bytes: {type: integer, minimum: 1}
                categories: {type: array, items: {type: string}}
                comment: {type: string, maxLength: 512}
                insecure_skip_tls_verify: {type: boolean}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: addressoverrides.fancydns.k6n.net
spec:
  group: fancydns.k6n.net
  scope: Namespaced
  names: {kind: AddressOverride, listKind: AddressOverrideList, plural: addressoverrides, singular: addressoverride, shortNames: [ao]}
  versions:
    - name: v1alpha1
      served: true
      storage: true
      additionalPrinterColumns:
        - {name: Domain, type: string, jsonPath: .spec.domain}
        - {name: Addresses, type: string, jsonPath: .spec.addresses}
        - {name: Age, type: date, jsonPath: .metadata.creationTimestamp}
      schema:
        openAPIV3Schema:
          type: object
          required: [spec]
          properties:
            spec:
              type: object
              required: [domain, addresses]
              properties:
                domain: {type: string, minLength: 1, maxLength: 253, description: "Answered with the addresses below, together with every name under it"}
                addresses:
                  type: array
                  minItems: 1
                  maxItems: 16
                  items: {type: string, description: "IPv4 or IPv6 literal"}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: domainrules.fancydns.k6n.net
spec:
  group: fancydns.k6n.net
  scope: Namespaced
  names: {kind: DomainRule, listKind: DomainRuleList, plural: domainrules, singular: domainrule, shortNames: [dr]}
  versions:
    - name: v1alpha1
      served: true
      storage: true
      additionalPrinterColumns:
        - {name: Action, type: string, jsonPath: .spec.action}
        - {name: Age, type: date, jsonPath: .metadata.creationTimestamp}
      schema:
        openAPIV3Schema:
          type: object
          required: [spec]
          properties:
            spec:
              type: object
              required: [action, names]
              properties:
                action: {type: string, enum: [block, allow], description: "allow rescues a name that a blocklist would block"}
                names:
                  type: array
                  maxItems: 5000
                  items: {type: string, description: "A name, or *.name (subdomains) / **.name (subdomains and the name)"}
                comment: {type: string, maxLength: 512}