{
  name           = "rustelo-leptos-server",
  workspace_id   = "example-pro",
  image_base     = "registry.example.com/example.com/rustelo-leptos-server",
  image_tag      = "latest",
  ctx_type       = 'leptos,
  domain         = "example.com",
  dns_zone       = "example.com",
  acme_email     = "jpl@example.com",
  namespace      = "example-pro",
  port           = 3000,
  component_type      = 'rustelo_website,
  leptos_output_name  = "website",

  data_pvc = {
    enabled       = true,
    size          = "2Gi",
    mount_path    = "/var/www",
    storage_class = "longhorn-retain",
  },

  requires = {
    storage              = { size = "2Gi", persistent = true },
    ports                = [{ port = 3000, exposure = 'public }],
    credentials          = ["SECRET_KEY", "DATABASE_URL"],
    dns_credential       = "dns-example-pro",
    registry_pull_secret = "registry-pull-secret",
  },

  provides = {
    service   = "website",
    port      = 3000,
    endpoints = ["https://example.com"],
  },

  operations = {
    install = true,
    update  = true,
    delete  = true,
    health  = true,
  },

  context = {
    how = "K8s Deployment in namespace example-pro; image registry.example.com/example.com/website (Leptos SSR, port 3000); 2Gi Longhorn-retain PVC at /var/www for content; image pulled via registry-pull-secret secret; TLS via cluster-issuer + Cloudflare DNS-01 on zone example.com; public Gateway API route via workspace FIP.",
    why = "Primary personal website for example.com — portfolio, blog, CV. Rustelo/Leptos SSR.",
    priority = 'standard,
    security = {
      posture  = 'public,
      tls      = true,
      concerns = ["secret-key-rotation", "reg-pull-secret-rotation"],
    },
    supervision = {
      health_check = true,
      metrics      = false,
      alerts       = ["website-pod-not-ready"],
    },
    updates = {
      policy = 'pinned,
      holds  = ["homepage-smoke", "health-endpoint-smoke"],
    },
  },

  build_secrets = {
    registry_push = "infra/libre-daoshi/secrets/registry-push.sops.yaml",
    sccache       = "infra/libre-daoshi/secrets/sccache.sops.yaml",
    cosign        = "infra/libre-daoshi/secrets/cosign.sops.yaml",
  },
}
