// Single source of truth for limits and layout. Mirrors SPEC.md; change both together.
#pragma once
#include <array>
#include <cstddef>
#include <cstdint>
#include <string_view>

namespace spec {

// Hard caps
constexpr std::size_t kMaxContainers = 64;
constexpr std::size_t kMaxNameLen = 32;
constexpr std::size_t kMaxCommandArgs = 256;
constexpr std::size_t kMaxTreeDepth = 256;       // removal recursion cap
constexpr unsigned long kMaxOpenFiles = 4096;    // RLIMIT_NOFILE ceiling inside
constexpr int kNetReadyTimeoutMs = 5000;         // slirp4netns must be ready by then
constexpr int kLockTimeoutMs = 5000;             // per-container lock wait
constexpr std::string_view kTmpSize = "256m";
constexpr std::string_view kRunSize = "64m";
constexpr std::string_view kShmSize = "64m";

// Writable-layer size cap per container (--size). Enforced by a watchdog that freezes the container.
constexpr std::uint64_t kDefaultSizeBytes = 4ULL << 30;
constexpr std::uint64_t kMinSizeBytes = 64ULL << 20;
constexpr std::uint64_t kMaxSizeBytes = 1ULL << 40;
constexpr int kSizeWarnPercent = 80;
constexpr int kSizeThawPercent = 95;             // thaw again below this share of the cap
constexpr int kSizeCheckMinIntervalMs = 2000;    // floor between usage scans, never faster
constexpr int kSizeScanDutyFactor = 10;          // next scan waits at least 10x the last scan's duration
constexpr std::size_t kMaxScanEntries = 5000000; // usage scan stops (and reports) beyond this
constexpr std::string_view kCgroupDir = "doos";  // under the delegated user@UID.service cgroup

// Resource limits per container (--memory, --pids, --cpus). Enforced by cgroup v2; cpus 0 means "all cores".
constexpr std::uint64_t kDefaultMemoryBytes = 8ULL << 30;
constexpr std::uint64_t kMinMemoryBytes = 64ULL << 20;
constexpr std::uint64_t kMaxMemoryBytes = 1ULL << 40;
constexpr std::uint32_t kDefaultPids = 4096;
constexpr std::uint32_t kMinPids = 16;
constexpr std::uint32_t kMaxPids = 4194304;
constexpr std::uint32_t kMaxMilliCpus = 1024000;  // 1024 cpus
constexpr std::uint32_t kMinMilliCpus = 100;      // 0.1 cpu
constexpr int kCpuPeriodUs = 100000;

// Seeding limits
constexpr std::size_t kMaxSkeletonDirs = 200000;
constexpr std::size_t kMaxEtcCopyFiles = 50000;
constexpr std::uint64_t kMaxEtcCopyBytes = 256ULL << 20;

// Id mapping: container ids 0..kMaxIdRange. 0 maps to the invoking user, the rest to the subuid range.
constexpr std::uint32_t kMaxIdRange = 65536;
constexpr std::string_view kNewUidMap = "newuidmap";
constexpr std::string_view kNewGidMap = "newgidmap";

// Images
constexpr std::size_t kMaxImages = 16;
constexpr std::uint64_t kMaxImageDownloadBytes = 2ULL << 30;
constexpr int kDownloadTimeoutSec = 900;
constexpr std::size_t kMaxCaptureBytes = 1 << 20;  // listing / checksum fetches
constexpr std::string_view kAlpineBase = "https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/";
constexpr std::string_view kUbuntuBase = "https://cdimage.ubuntu.com/ubuntu-base/releases/";
constexpr std::string_view kUbuntuDefaultVersion = "26.04";
constexpr std::string_view kDebianBase = "https://raw.githubusercontent.com/debuerreotype/docker-debian-artifacts/";
constexpr std::string_view kDebianDefaultRelease = "trixie";

// Release signing keys, pinned by fingerprint. Keys are fetched from the publisher and rejected unless the
// fingerprint matches. Sources of the fingerprints: alpinelinux.org/downloads, ubuntu.com verify tutorial.
constexpr std::string_view kAlpineKeyUrl = "https://alpinelinux.org/keys/ncopa.asc";
constexpr std::string_view kAlpineKeyFpr = "0482D84022F52DF1C4E7CD43293ACD0907D9495A";
constexpr std::string_view kUbuntuKeyUrl =
    "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x843938DF228D22F7B3742BC0D94AA3F0EFE21092";
constexpr std::string_view kUbuntuKeyFpr = "843938DF228D22F7B3742BC0D94AA3F0EFE21092";

// Networking
constexpr std::string_view kSlirpBinary = "slirp4netns";
constexpr std::string_view kSlirpDns = "10.0.2.3";
constexpr std::string_view kSlirpTapName = "tap0";

// Container identity
constexpr std::string_view kContainerPath =
    "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
constexpr std::string_view kHome = "/root";

// Host directories exposed as overlay lowerdirs. Writes land in the per-container upperdir.
constexpr std::array<std::string_view, 2> kOverlayDirs = {"/usr", "/opt"};

// Host directories copied once into a private per-container dir (owned by the container root, so
// chown --reference and in-place edits work). Unreadable entries are skipped and counted.
constexpr std::array<std::string_view, 1> kCopiedDirs = {"/etc"};

// Host mode /etc under --hardening default: only these entries are copied (relaxed copies everything readable).
// Entries that may hold credentials are skipped even inside allowed directories.
constexpr std::array<std::string_view, 53> kEtcAllow = {
    "passwd", "group", "nsswitch.conf", "hosts", "hostname", "host.conf", "localtime", "timezone", "machine-id",
    "ld.so.conf", "ld.so.conf.d", "ld.so.cache", "ssl", "ca-certificates", "ca-certificates.conf", "pki",
    "alternatives", "apt", "dpkg", "bash.bashrc", "bashrc", "profile", "profile.d", "environment", "inputrc",
    "os-release", "lsb-release", "issue", "issue.net", "debian_version", "shells", "protocols", "services",
    "mime.types", "magic", "gai.conf", "locale.gen", "locale.conf", "default", "gitconfig", "bash_completion",
    "bash_completion.d", "vim", "emacs", "xdg", "fonts", "mailcap", "wgetrc", "ssh/ssh_config",
    "ssh/ssh_config.d", "perl", "python3", "terminfo"};
constexpr std::array<std::string_view, 8> kEtcDenyNames = {"private", "shadow", "gshadow", "sudoers", "sudoers.d",
                                                           "auth.conf", "auth.conf.d", "ssh_host_*"};

// Capabilities kept in the bounding set under --hardening default (the Docker default set).
constexpr std::array<int, 14> kKeptCaps = {0 /*CHOWN*/,  1 /*DAC_OVERRIDE*/, 3 /*FOWNER*/, 4 /*FSETID*/,
                                           5 /*KILL*/,   6 /*SETGID*/,       7 /*SETUID*/, 8 /*SETPCAP*/,
                                           10 /*NET_BIND_SERVICE*/, 13 /*NET_RAW*/, 18 /*SYS_CHROOT*/,
                                           27 /*MKNOD*/, 29 /*AUDIT_WRITE*/, 31 /*SETFCAP*/};

// Extra overlay mounted inside the private /var, only when the host has the directory (dpkg database).
constexpr std::array<std::string_view, 1> kVarOverlayDirs = {"/var/lib/dpkg"};

// Lock files that exist on the host owned by an unmapped uid: an empty copy is created in the upper layer so
// the container can open them for writing. Each must live under one of the overlay dirs above.
constexpr std::array<std::string_view, 3> kUpperLockFiles = {"/var/lib/dpkg/lock", "/var/lib/dpkg/lock-frontend",
                                                              "/var/lib/dpkg/triggers/Lock"};

// Directories whose regular files (not subdirs) are copied into the upper layer at creation, so the container
// owns them: dpkg hard-links `status` to `status-old`, which the kernel refuses for files owned by nobody.
constexpr std::array<std::string_view, 3> kUpperCopyDirs = {"/var/lib/dpkg", "/var/lib/dpkg/triggers",
                                                             "/var/lib/dpkg/alternatives"};

struct DirSpec {
    std::string_view path;
    unsigned mode;
};
// Directories created in the private /var (package managers expect them).
constexpr std::array<DirSpec, 8> kVarDirs = {{{"lib/apt/lists/partial", 0755},
                                              {"lib/dpkg", 0755},
                                              {"cache/apt/archives/partial", 0755},
                                              {"log/apt", 0755},
                                              {"tmp", 01777},
                                              {"lib/apt", 0755},
                                              {"cache", 0755},
                                              {"log", 0755}}};

// Host top-level entries: recreated as symlinks when the host has them as symlinks (usr-merge),
// overlaid like kOverlayDirs when they are real directories, skipped when absent.
constexpr std::array<std::string_view, 5> kCompatDirs = {"/bin", "/sbin", "/lib", "/lib32", "/lib64"};

// Persistent per-container private directories (no host lower layer).
constexpr std::array<std::string_view, 3> kPrivateDirs = {"/root", "/var", "/etc"};

// Empty mountpoints / tmpfs
constexpr std::array<std::string_view, 6> kEmptyDirs = {"/mnt", "/srv", "/tmp", "/run", "/dev", "/proc"};

// Host device nodes bound into the container /dev (no mknod possible in a userns).
constexpr std::array<std::string_view, 6> kDevices = {"null", "zero", "full", "random", "urandom", "tty"};

// /proc paths remounted read-only, or hidden behind /dev/null.
constexpr std::array<std::string_view, 5> kProcReadOnly = {"/proc/sys", "/proc/sysrq-trigger", "/proc/irq",
                                                           "/proc/bus", "/proc/fs"};
constexpr std::array<std::string_view, 3> kProcMasked = {"/proc/kcore", "/proc/keys", "/proc/timer_list"};

}  // namespace spec