"""Infomaniak Public Cloud / Magogi domain defaults (DESIGN §6).

Pure, non-secret data: the region, image, flavour, network, SSH user, S3
endpoint, the standard ingress rules, and an org-hardening cloud-init template.
These seed :class:`~mgf.cloud.models.ServerSpec` builders and the CLI so callers
don't re-type the federation's conventions.

**No account identity or secrets live here.** The endpoint and region below are
the public Infomaniak defaults; the *live* project's user/project-UUID/password
come only from ``clouds.yaml`` (see ``my_stuff/infomaniak/FACTS.md``). This module
imports no provider SDK, so ``import mgf.cloud.defaults`` stays light.
"""

from __future__ import annotations

from mgf.cloud.models import SecurityRule

__all__ = [
    "AUTH_URL",
    "DEFAULT_CLOUD_INIT",
    "DEFAULT_FLAVOR",
    "DEFAULT_FLOATING_NETWORK",
    "DEFAULT_IMAGE",
    "DEFAULT_INGRESS_PORTS",
    "DEFAULT_NETWORK",
    "DEFAULT_SSH_USER",
    "REGION",
    "REGION_DR",
    "S3_ENDPOINT",
    "SCALE_FLAVOR",
    "default_ingress_rules",
]

# --- endpoint / placement (public Infomaniak defaults; confirmed live, FACTS.md) -
AUTH_URL = "https://api.pub1.infomaniak.cloud/identity/v3"
REGION = "dc3-a"  # Geneva (primary)
REGION_DR = "dc4-a"  # disaster-recovery region

# --- compute shape (confirmed live 2026-06-15 against dc3-a) --------------------
# Infomaniak's smallest shape is 1 vCPU / 4 GB (there is no 2 GB flavour), and
# images carry their release codename. Names verified via list_flavors/list_images.
DEFAULT_IMAGE = "Ubuntu 24.04 LTS Noble Numbat"
DEFAULT_FLAVOR = "a1-ram4-disk20-perf1"  # 1 vCPU / 4 GB / 20 GB — the nano shape
SCALE_FLAVOR = "a2-ram4-disk20-perf1"  # 2 vCPU / 4 GB / 20 GB — scale-up

# --- network -------------------------------------------------------------------
DEFAULT_NETWORK = "ext-net1"  # the network instances boot onto
DEFAULT_FLOATING_NETWORK = "ext-floating1"  # the EXTERNAL pool floating IPs come from
# (distinct: allocating a floating IP from ext-net1 is a 400 "not a valid external network")
DEFAULT_SSH_USER = "ubuntu"  # the Ubuntu image's default login (key-only)
S3_ENDPOINT = "https://s3.pub1.infomaniak.cloud/"

# The service ports the standard security group opens (ingress). 22 for SSH,
# 80/443 for HTTP(S). Egress :25 is left blocked at the host (DESIGN §6) — no
# direct mail; relay through a provider.
DEFAULT_INGRESS_PORTS: tuple[int, ...] = (22, 80, 443)


def default_ingress_rules(
    ports: tuple[int, ...] = DEFAULT_INGRESS_PORTS,
    remote_ip_prefix: str = "0.0.0.0/0",
) -> tuple[SecurityRule, ...]:
    """The standard ingress rules — one TCP rule per port in ``ports``."""
    return tuple(
        SecurityRule(
            direction="ingress",
            protocol="tcp",
            port_min=port,
            port_max=port,
            remote_ip_prefix=remote_ip_prefix,
        )
        for port in ports
    )


# The org-hardening cloud-init applied to every federation host (DESIGN §6):
# unattended-upgrades, a default-deny ufw opening only 22/80/443, fail2ban,
# SSH lockdown (key-only, no root), a journald size cap, and a nightly reboot
# window. Consumers can extend it; it is intentionally conservative.
DEFAULT_CLOUD_INIT = """\
#cloud-config
package_update: true
package_upgrade: true
packages:
  - unattended-upgrades
  - ufw
  - fail2ban
runcmd:
  - [ ufw, default, deny, incoming ]
  - [ ufw, default, allow, outgoing ]
  - [ ufw, allow, "22/tcp" ]
  - [ ufw, allow, "80/tcp" ]
  - [ ufw, allow, "443/tcp" ]
  - [ ufw, deny, out, "25" ]
  - [ ufw, --force, enable ]
  - [ systemctl, enable, --now, fail2ban ]
  - [ systemctl, enable, --now, unattended-upgrades ]
ssh_pwauth: false
disable_root: true
write_files:
  - path: /etc/systemd/journald.conf.d/00-cap.conf
    content: |
      [Journal]
      SystemMaxUse=200M
"""
