controller.nix

# Seed controller — reconciles instance definitions into Kata pods
#
# Deploys as k8s-native components:
#   - seed-controller: Deployment pod (reconciliation engine + webhook)
#   - seed-host-agent: DaemonSet pod (privileged, manages swtpm on host)
#   - seed-builder: Jobs created by controller for nix build/eval
#
# The controller runs inside the cluster with proper RBAC, communicates
# via standard k8s primitives (CRDs, ConfigMaps, Jobs), and self-heals.
{ config, lib, pkgs, ... }:

let
  cfg = config.seed.controller;

  # SeedHostTask CRD definition
  seedHostTaskCRD = pkgs.writeText "seed-hosttask-crd.yaml" (builtins.toJSON {
    apiVersion = "apiextensions.k8s.io/v1";
    kind = "CustomResourceDefinition";
    metadata.name = "seedhosttasks.seed.loom.farm";
    spec = {
      group = "seed.loom.farm";
      versions = [{
        name = "v1alpha1";
        served = true;
        storage = true;
        schema.openAPIV3Schema = {
          type = "object";
          properties = {
            spec = {
              type = "object";
              properties = {
                type = { type = "string"; };
                instance = { type = "string"; };
                namespace = { type = "string"; };
              };
              required = [ "type" "instance" "namespace" ];
            };
            status = {
              type = "object";
              properties = {
                ready = { type = "boolean"; };
                socketPath = { type = "string"; };
                message = { type = "string"; };
              };
            };
          };
        };
        subresources.status = {};
      }];
      scope = "Namespaced";
      names = {
        plural = "seedhosttasks";
        singular = "seedhosttask";
        kind = "SeedHostTask";
        shortNames = [ "sht" ];
      };
    };
  });

  # SeedFlake CRD definition — dynamic flake registry with invite codes
  seedFlakeCRD = pkgs.writeText "seed-flake-crd.yaml" (builtins.toJSON {
    apiVersion = "apiextensions.k8s.io/v1";
    kind = "CustomResourceDefinition";
    metadata.name = "seedflakes.seed.loom.farm";
    spec = {
      group = "seed.loom.farm";
      versions = [{
        name = "v1alpha1";
        served = true;
        storage = true;
        schema.openAPIV3Schema = {
          type = "object";
          properties = {
            spec = {
              type = "object";
              properties = {
                inviteCode = { type = "string"; };
                flakeUri = { type = "string"; };
                identity = { type = "string"; };
              };
            };
            status = {
              type = "object";
              properties = {
                namespace = { type = "string"; };
                state = { type = "string"; enum = [ "pending" "active" ]; };
                generation = { type = "string"; };
                lastReconciled = { type = "string"; };
              };
            };
          };
        };
        subresources.status = {};
      }];
      scope = "Cluster";
      names = {
        plural = "seedflakes";
        singular = "seedflake";
        kind = "SeedFlake";
        shortNames = [ "sf" ];
      };
    };
  });

  # SeedDNSRecord CRD definition
  seedDNSRecordCRD = pkgs.writeText "seed-dnsrecord-crd.yaml" (builtins.toJSON {
    apiVersion = "apiextensions.k8s.io/v1";
    kind = "CustomResourceDefinition";
    metadata.name = "seeddnsrecords.seed.loom.farm";
    spec = {
      group = "seed.loom.farm";
      versions = [{
        name = "v1alpha1";
        served = true;
        storage = true;
        schema.openAPIV3Schema = {
          type = "object";
          properties = {
            spec = {
              type = "object";
              properties = {
                name = { type = "string"; };
                type = { type = "string"; enum = [ "A" "AAAA" "CNAME" ]; };
                ttl = { type = "integer"; };
                records = {
                  type = "array";
                  items = {
                    type = "object";
                    properties = {
                      content = { type = "string"; };
                    };
                    required = [ "content" ];
                  };
                };
                sourceRef = {
                  type = "object";
                  properties = {
                    kind = { type = "string"; };
                    name = { type = "string"; };
                  };
                  required = [ "kind" "name" ];
                };
                domainRef = {
                  type = "object";
                  properties = {
                    name = { type = "string"; };
                  };
                  required = [ "name" ];
                };
              };
              required = [ "name" "type" "ttl" ];
            };
            status = {
              type = "object";
              properties = {
                synced = { type = "boolean"; };
                resolvedRecords = {
                  type = "array";
                  items = {
                    type = "object";
                    properties = {
                      content = { type = "string"; };
                    };
                  };
                };
                message = { type = "string"; };
                lastSyncedAt = { type = "string"; };
              };
            };
          };
        };
        subresources.status = {};
        additionalPrinterColumns = [
          { name = "DNS Name"; type = "string"; jsonPath = ".spec.name"; }
          { name = "Type"; type = "string"; jsonPath = ".spec.type"; }
          { name = "Synced"; type = "boolean"; jsonPath = ".status.synced"; }
          { name = "Age"; type = "date"; jsonPath = ".metadata.creationTimestamp"; }
        ];
      }];
      scope = "Namespaced";
      names = {
        plural = "seeddnsrecords";
        singular = "seeddnsrecord";
        kind = "SeedDNSRecord";
        shortNames = [ "sdr" ];
      };
    };
  });

  # SeedDomain CRD definition — domain registration + zone lifecycle
  seedDomainCRD = pkgs.writeText "seed-domain-crd.yaml" (builtins.toJSON {
    apiVersion = "apiextensions.k8s.io/v1";
    kind = "CustomResourceDefinition";
    metadata.name = "seeddomains.seed.loom.farm";
    spec = {
      group = "seed.loom.farm";
      versions = [{
        name = "v1alpha1";
        served = true;
        storage = true;
        schema.openAPIV3Schema = {
          type = "object";
          properties = {
            spec = {
              type = "object";
              properties = {
                name = { type = "string"; };
                register = { type = "boolean"; };
                registrar = { type = "string"; enum = [ "namesilo" ]; };
              };
              required = [ "name" ];
            };
            status = {
              type = "object";
              properties = {
                phase = { type = "string"; enum = [
                  "Pending" "Registering" "Registered" "Delegating"
                  "Delegated" "ZoneReady" "Error"
                ]; };
                registered = { type = "boolean"; };
                nsConfigured = { type = "boolean"; };
                zoneReady = { type = "boolean"; };
                registrarDomainId = { type = "string"; };
                expiresAt = { type = "string"; };
                message = { type = "string"; };
                lastSyncedAt = { type = "string"; };
              };
            };
          };
        };
        subresources.status = {};
        additionalPrinterColumns = [
          { name = "Domain"; type = "string"; jsonPath = ".spec.name"; }
          { name = "Phase"; type = "string"; jsonPath = ".status.phase"; }
          { name = "Zone Ready"; type = "boolean"; jsonPath = ".status.zoneReady"; }
          { name = "Expires"; type = "string"; jsonPath = ".status.expiresAt"; }
          { name = "Age"; type = "date"; jsonPath = ".metadata.creationTimestamp"; }
        ];
      }];
      scope = "Namespaced";
      names = {
        plural = "seeddomains";
        singular = "seeddomain";
        kind = "SeedDomain";
        shortNames = [ "sd" ];
      };
    };
  });

  # Namespace for seed system components
  seedSystemNS = "seed-system";

  # Standard labels for system components
  systemLabels = component: {
    "app.kubernetes.io/name" = "seed-${component}";
    "app.kubernetes.io/part-of" = "seed";
    "seed.loom.farm/managed-by" = "seed";
    "seed.loom.farm/component" = component;
  };

  # ServiceAccount for controller
  controllerSA = pkgs.writeText "seed-controller-sa.yaml" (builtins.toJSON {
    apiVersion = "v1";
    kind = "ServiceAccount";
    metadata = {
      name = "seed-controller";
      namespace = seedSystemNS;
    };
  });

  # ServiceAccount for builder Jobs
  builderSA = pkgs.writeText "seed-builder-sa.yaml" (builtins.toJSON {
    apiVersion = "v1";
    kind = "ServiceAccount";
    metadata = {
      name = "seed-builder";
      namespace = seedSystemNS;
    };
  });

  # ClusterRole for controller
  controllerRole = pkgs.writeText "seed-controller-role.yaml" (builtins.toJSON {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRole";
    metadata.name = "seed-controller";
    rules = [
      {
        apiGroups = [ "" ];
        resources = [ "namespaces" "pods" "persistentvolumeclaims" "services" "configmaps" "endpoints" "events" "nodes" "secrets" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "" ];
        resources = [ "pods/log" ];
        verbs = [ "get" ];
      }
      {
        apiGroups = [ "apps" ];
        resources = [ "deployments" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "batch" ];
        resources = [ "jobs" ];
        verbs = [ "get" "list" "watch" "create" "delete" ];
      }
      {
        apiGroups = [ "node.k8s.io" ];
        resources = [ "runtimeclasses" ];
        verbs = [ "get" "create" "update" "patch" ];
      }
      {
        apiGroups = [ "metallb.io" ];
        resources = [ "ipaddresspools" "l2advertisements" "bgppeers" "bgpadvertisements" ];
        verbs = [ "get" "list" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "seed.loom.farm" ];
        resources = [ "seedhosttasks" "seedhosttasks/status" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "seed.loom.farm" ];
        resources = [ "seedflakes" "seedflakes/status" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "seed.loom.farm" ];
        resources = [ "seeddnsrecords" "seeddnsrecords/status" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "seed.loom.farm" ];
        resources = [ "seeddomains" "seeddomains/status" ];
        verbs = [ "get" "list" "watch" "create" "update" "patch" "delete" ];
      }
      {
        apiGroups = [ "cert-manager.io" ];
        resources = [ "certificaterequests" ];
        verbs = [ "get" "create" "delete" ];
      }
    ];
  });

  # ClusterRoleBinding for controller
  controllerRoleBinding = pkgs.writeText "seed-controller-rolebinding.yaml" (builtins.toJSON {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRoleBinding";
    metadata.name = "seed-controller";
    subjects = [{
      kind = "ServiceAccount";
      name = "seed-controller";
      namespace = seedSystemNS;
    }];
    roleRef = {
      apiGroup = "rbac.authorization.k8s.io";
      kind = "ClusterRole";
      name = "seed-controller";
    };
  });

  # ClusterRole for builder (needs configmap write in instance namespace)
  builderRole = pkgs.writeText "seed-builder-role.yaml" (builtins.toJSON {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRole";
    metadata.name = "seed-builder";
    rules = [
      {
        apiGroups = [ "" ];
        resources = [ "configmaps" ];
        verbs = [ "get" "create" "update" "patch" ];
      }
    ];
  });

  builderRoleBinding = pkgs.writeText "seed-builder-rolebinding.yaml" (builtins.toJSON {
    apiVersion = "rbac.authorization.k8s.io/v1";
    kind = "ClusterRoleBinding";
    metadata.name = "seed-builder";
    subjects = [{
      kind = "ServiceAccount";
      name = "seed-builder";
      namespace = seedSystemNS;
    }];
    roleRef = {
      apiGroup = "rbac.authorization.k8s.io";
      kind = "ClusterRole";
      name = "seed-builder";
    };
  });

  # Controller Deployment
  controllerDeployment = pkgs.writeText "seed-controller-deployment.yaml" (builtins.toJSON {
    apiVersion = "apps/v1";
    kind = "Deployment";
    metadata = {
      name = "seed-controller";
      namespace = seedSystemNS;
      labels = systemLabels "controller";
    };
    spec = {
      replicas = 1;
      selector.matchLabels."app.kubernetes.io/name" = "seed-controller";
      template = {
        metadata.labels = systemLabels "controller";
        spec = {
          serviceAccountName = "seed-controller";
          # Pin to this node — controller needs hostPath secrets (sops-nix)
          nodeSelector."kubernetes.io/hostname" = config.networking.hostName;
          # Default runtime — controller doesn't need Kata
          containers = [{
            name = "controller";
            image = "nix:0${cfg.controllerImage}";
            command = [ "${pkgs.nodejs_22}/bin/node" "/app/controller.mjs" ];
            # Cluster-level config (reserved IPs, etc.) from ConfigMap.
            # Created by provisioner after cluster bootstrap. Optional so the
            # controller starts even before the ConfigMap exists.
            envFrom = [{
              configMapRef = {
                name = "seed-cluster-config";
                optional = true;
              };
            }];
            env = [
              { name = "SEED_FLAKE_PATHS"; value = builtins.concatStringsSep "," cfg.flakePaths; }
              { name = "SEED_WEBHOOK_PORT"; value = toString cfg.webhook.port; }
              { name = "SEED_SWTPM_ENABLED"; value = if cfg.swtpmEnabled then "1" else ""; }
              { name = "SEED_BUILDER_IMAGE"; value = cfg.builderImage; }
              # nix needs flakes + nix-command enabled, and daemon mode (store is read-only mount)
              { name = "NIX_CONFIG"; value = "experimental-features = nix-command flakes"; }
              { name = "NIX_REMOTE"; value = "daemon"; }
              # CA certs for HTTPS (nix fetching from GitHub)
              { name = "NIX_SSL_CERT_FILE"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              { name = "SSL_CERT_FILE"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              { name = "GIT_SSL_CAINFO"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              # PATH: nix + git + coreutils (for nix eval/build)
              { name = "PATH"; value = lib.makeBinPath [ pkgs.nix pkgs.git pkgs.coreutils pkgs.gnutar pkgs.gzip pkgs.xz pkgs.age pkgs.age-plugin-tpm ]; }
              { name = "SEED_SILO_HOST"; value = cfg.siloHost; }
            ] ++ lib.optional (cfg.ipv4Address != "") {
              name = "SEED_IPV4_ADDRESS"; value = cfg.ipv4Address;
            } ++ lib.optional (cfg.ipv6Block != "") {
              name = "SEED_IPV6_BLOCK"; value = cfg.ipv6Block;
            } ++ lib.optionals cfg.bgp.enable [
              { name = "SEED_BGP_MY_ASN"; value = toString cfg.bgp.myASN; }
              { name = "SEED_BGP_PEER_ASN"; value = toString cfg.bgp.peerASN; }
              { name = "SEED_BGP_PEER_ADDRESS"; value = cfg.bgp.peerAddress; }
              { name = "SEED_BGP_PEER_ADDRESS_IPV6"; value = cfg.bgp.peerAddressIPv6; }
              { name = "SEED_BGP_PASSWORD"; value = cfg.bgp.password; }
            ] ++ lib.optional (cfg.dns.apiUrl != "") {
              name = "SEED_PDNS_API_URL"; value = cfg.dns.apiUrl;
            } ++ lib.optional (cfg.dns.apiKeyFile != "") {
              name = "SEED_PDNS_API_KEY_FILE"; value = cfg.dns.apiKeyFile;
            } ++ lib.optional (cfg.dns.zone != "loom.farm.") {
              name = "SEED_PDNS_ZONE"; value = cfg.dns.zone;
            } ++ lib.optional (cfg.dns.instanceDomain != "seed.loom.farm") {
              name = "SEED_INSTANCE_DOMAIN"; value = cfg.dns.instanceDomain;
            } ++ lib.optional (cfg.registrar.apiKeyFile != "") {
              name = "SEED_NAMESILO_API_KEY_FILE"; value = cfg.registrar.apiKeyFile;
            } ++ lib.optional (cfg.webhook.secretFile != "") {
              name = "SEED_WEBHOOK_SECRET_FILE"; value = cfg.webhook.secretFile;
            } ++ lib.optional (cfg.acme.accountKey != "") {
              name = "SEED_ACME_ACCOUNT_KEY_FILE"; value = "/etc/seed/acme/account-key.pem";
            } ++ lib.optional (cfg.acme.accountKey != "") {
              name = "SEED_ACME_ENABLED"; value = "1";
            } ++ lib.optional cfg.poolManager.enable {
              name = "SEED_POOL_MANAGER_URL"; value = "http://seed-pool-manager.${seedSystemNS}.svc.cluster.local:${toString cfg.poolManager.port}";
            };
            ports = [{
              containerPort = cfg.webhook.port;
              name = "webhook";
              protocol = "TCP";
            }];
            volumeMounts = [
              { name = "nix-daemon"; mountPath = "/nix/var/nix/daemon-socket"; }
              { name = "nix-store"; mountPath = "/nix/store"; readOnly = true; }
              { name = "secrets"; mountPath = "/etc/seed/secrets"; readOnly = true; }
              { name = "tpm-state"; mountPath = "/var/lib/seed-controller/tpm"; readOnly = true; }
              { name = "tls"; mountPath = "/etc/seed/tls"; readOnly = true; }
            ] ++ lib.optional (cfg.acme.accountKey != "") {
              name = "acme-account-key";
              mountPath = "/etc/seed/acme";
              readOnly = true;
            };
          }];
          volumes = [
            { name = "nix-daemon"; hostPath.path = "/nix/var/nix/daemon-socket"; }
            { name = "nix-store"; hostPath.path = "/nix/store"; }
            { name = "secrets"; secret = { secretName = "seed-controller-secrets"; optional = true; }; }
            { name = "tpm-state"; hostPath = { path = "/var/lib/seed-controller/tpm"; type = "DirectoryOrCreate"; }; }
            { name = "tls"; secret.secretName = "seed-controller-tls"; }
          ] ++ lib.optional (cfg.acme.accountKey != "") {
            name = "acme-account-key";
            secret.secretName = "seed-acme-account-key";
          };
        };
      };
    };
  });

  # Controller webhook Service (for Caddy reverse proxy)
  controllerService = pkgs.writeText "seed-controller-service.yaml" (builtins.toJSON {
    apiVersion = "v1";
    kind = "Service";
    metadata = {
      name = "seed-controller";
      namespace = seedSystemNS;
    };
    spec = {
      selector."app.kubernetes.io/name" = "seed-controller";
      ports = [{
        port = cfg.webhook.port;
        targetPort = cfg.webhook.port;
        protocol = "TCP";
        name = "webhook";
      }];
    };
  });

  # Host agent DaemonSet (privileged — manages swtpm on host)
  hostAgentDaemonSet = pkgs.writeText "seed-host-agent-daemonset.yaml" (builtins.toJSON {
    apiVersion = "apps/v1";
    kind = "DaemonSet";
    metadata = {
      name = "seed-host-agent";
      namespace = seedSystemNS;
      labels = systemLabels "host-agent";
    };
    spec = {
      selector.matchLabels."app.kubernetes.io/name" = "seed-host-agent";
      template = {
        metadata.labels = systemLabels "host-agent";
        spec = {
          serviceAccountName = "seed-controller";
          # Default runtime — host agent needs host access, not Kata
          hostPID = false;
          hostNetwork = true;
          containers = [{
            name = "host-agent";
            image = "nix:0${cfg.hostAgentImage}";
            command = [ "${pkgs.nodejs_22}/bin/node" "/app/host-agent.mjs" ];
            securityContext.privileged = true;
            env = [
              { name = "SEED_NETPOL_ENABLED"; value = if cfg.netpol.enable then "1" else ""; }
              { name = "SEED_CLUSTER_CIDR"; value = "10.42.0.0/16,fd00::/56"; }
              { name = "SEED_SERVICE_CIDR"; value = "10.43.0.0/16,fd01::/108"; }
              { name = "SEED_DNS_IP"; value = "10.43.0.10"; }
              {
                name = "SEED_NODE_NAME";
                valueFrom.fieldRef.fieldPath = "spec.nodeName";
              }
            ];
            volumeMounts = [
              { name = "tpm-state"; mountPath = "/var/lib/seed-controller/tpm"; }
              { name = "swtpm-sockets"; mountPath = "/run/swtpm"; }
            ];
          }];
          volumes = [
            { name = "tpm-state"; hostPath = { path = "/var/lib/seed-controller/tpm"; type = "DirectoryOrCreate"; }; }
            { name = "swtpm-sockets"; hostPath = { path = "/run/swtpm"; type = "DirectoryOrCreate"; }; }
          ];
        };
      };
    };
  });

  # Pool manager DaemonSet (privileged — manages CLH VMs on host)
  poolManagerDaemonSet = pkgs.writeText "seed-pool-manager-daemonset.yaml" (builtins.toJSON {
    apiVersion = "apps/v1";
    kind = "DaemonSet";
    metadata = {
      name = "seed-pool-manager";
      namespace = seedSystemNS;
      labels = systemLabels "pool-manager";
    };
    spec = {
      selector.matchLabels."app.kubernetes.io/name" = "seed-pool-manager";
      template = {
        metadata.labels = systemLabels "pool-manager";
        spec = {
          serviceAccountName = "seed-controller";
          hostPID = false;
          hostNetwork = true;
          containers = [{
            name = "pool-manager";
            image = "nix:0${cfg.poolManager.image}";
            command = [ "${pkgs.nodejs_22}/bin/node" "/app/pool-manager.mjs" ];
            securityContext.privileged = true;
            env = [
              { name = "SEED_POOL_SIZE"; value = toString cfg.poolManager.poolSize; }
              { name = "SEED_POOL_PORT"; value = toString cfg.poolManager.port; }
              { name = "NIX_REMOTE"; value = "daemon"; }
              { name = "NIX_CONFIG"; value = "experimental-features = nix-command flakes"; }
              { name = "NIX_SSL_CERT_FILE"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              { name = "SSL_CERT_FILE"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              { name = "GIT_SSL_CAINFO"; value = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }
              { name = "PATH"; value = lib.makeBinPath [ pkgs.nix pkgs.git pkgs.coreutils pkgs.gnutar pkgs.gzip pkgs.xz pkgs.socat ]; }
            ];
            ports = [{
              containerPort = cfg.poolManager.port;
              name = "api";
              protocol = "TCP";
            }];
            volumeMounts = [
              { name = "nix-store"; mountPath = "/nix/store"; readOnly = true; }
              { name = "nix-var"; mountPath = "/nix/var/nix"; }
              { name = "nix-cache"; mountPath = "/root/.cache/nix"; }
              { name = "dev-kvm"; mountPath = "/dev/kvm"; }
              { name = "dev-vhost-vsock"; mountPath = "/dev/vhost-vsock"; }
              { name = "pool-state"; mountPath = "/run/seed-pool"; }
              { name = "k3s-storage"; mountPath = "/var/lib/rancher/k3s/storage"; }
            ];
          }];
          volumes = [
            { name = "nix-store"; hostPath.path = "/nix/store"; }
            { name = "nix-var"; hostPath = { path = "/nix/var/nix"; type = "Directory"; }; }
            { name = "nix-cache"; hostPath = { path = "/root/.cache/nix"; type = "DirectoryOrCreate"; }; }
            { name = "dev-kvm"; hostPath = { path = "/dev/kvm"; type = "CharDevice"; }; }
            { name = "dev-vhost-vsock"; hostPath = { path = "/dev/vhost-vsock"; type = "CharDevice"; }; }
            { name = "pool-state"; hostPath = { path = "/var/lib/seed-pool"; type = "DirectoryOrCreate"; }; }
            { name = "k3s-storage"; hostPath = { path = "/var/lib/rancher/k3s/storage"; type = "DirectoryOrCreate"; }; }
          ];
        };
      };
    };
  });

  # Pool manager Service — internalTrafficPolicy: Local ensures requests
  # from instance pods always reach the pool manager on the same node.
  # This is critical because shoots mount node-local PVC storage via virtiofs.
  poolManagerService = pkgs.writeText "seed-pool-manager-service.yaml" (builtins.toJSON {
    apiVersion = "v1";
    kind = "Service";
    metadata = {
      name = "seed-pool-manager";
      namespace = seedSystemNS;
    };
    spec = {
      selector."app.kubernetes.io/name" = "seed-pool-manager";
      internalTrafficPolicy = "Local";
      ports = [{
        port = cfg.poolManager.port;
        targetPort = cfg.poolManager.port;
        protocol = "TCP";
        name = "api";
      }];
    };
  });

  # TLS Certificate for the controller (issued by seed-ca via cert-manager)
  controllerCert = pkgs.writeText "seed-controller-cert.yaml" (builtins.toJSON {
    apiVersion = "cert-manager.io/v1";
    kind = "Certificate";
    metadata = {
      name = "seed-controller-tls";
      namespace = seedSystemNS;
    };
    spec = {
      secretName = "seed-controller-tls";
      duration = "2160h"; # 90 days
      renewBefore = "720h"; # 30 days before expiry
      privateKey = {
        algorithm = "ECDSA";
        size = 256;
      };
      dnsNames = [
        "seed-controller"
        "seed-controller.${seedSystemNS}"
        "seed-controller.${seedSystemNS}.svc"
        "seed-controller.${seedSystemNS}.svc.cluster.local"
      ];
      issuerRef = {
        name = "seed-ca";
        kind = "ClusterIssuer";
        group = "cert-manager.io";
      };
    };
  });

  # Namespace manifest
  seedSystemNamespace = pkgs.writeText "seed-system-namespace.yaml" (builtins.toJSON {
    apiVersion = "v1";
    kind = "Namespace";
    metadata.name = seedSystemNS;
  });

  # ACME account key k8s Secret — JSON with sops placeholder for runtime substitution.
  # The calling profile creates sops.templates from this and passes the rendered
  # path via extraManifestPaths. Same pattern as mkCephCsiRbd.secretManifestJSON.
  acmeSecretJSON = builtins.toJSON {
    apiVersion = "v1";
    kind = "Secret";
    metadata = {
      name = "seed-acme-account-key";
      namespace = seedSystemNS;
    };
    data = {
      "account-key.pem" = cfg.acme.accountKey;
    };
  };

  # Combined manifests directory for seed.k8s.services
  controllerManifests = pkgs.linkFarm "seed-controller-manifests" (
    [
      { name = "01-namespace.json"; path = seedSystemNamespace; }
      { name = "02-hosttask-crd.json"; path = seedHostTaskCRD; }
      { name = "02-flake-crd.json"; path = seedFlakeCRD; }
      { name = "02-dnsrecord-crd.json"; path = seedDNSRecordCRD; }
      { name = "02-domain-crd.json"; path = seedDomainCRD; }
      { name = "03-controller-sa.json"; path = controllerSA; }
      { name = "03-builder-sa.json"; path = builderSA; }
      { name = "04-controller-role.json"; path = controllerRole; }
      { name = "04-controller-rolebinding.json"; path = controllerRoleBinding; }
      { name = "04-builder-role.json"; path = builderRole; }
      { name = "04-builder-rolebinding.json"; path = builderRoleBinding; }
      { name = "05-controller-cert.json"; path = controllerCert; }
      { name = "05-controller-deployment.json"; path = controllerDeployment; }
      { name = "05-controller-service.json"; path = controllerService; }
    ]
    ++ lib.optional cfg.swtpmEnabled
      { name = "05-host-agent-daemonset.json"; path = hostAgentDaemonSet; }
    ++ lib.optionals cfg.poolManager.enable [
      { name = "05-pool-manager-daemonset.json"; path = poolManagerDaemonSet; }
      { name = "05-pool-manager-service.json"; path = poolManagerService; }
    ]
  );
in {
  options.seed.controller = {
    enable = lib.mkEnableOption "Seed instance controller";

    flakePaths = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [];
      description = "Bootstrap flake paths containing seeds.* outputs. Additional flakes can be registered dynamically via SeedFlake CRDs.";
    };

    ipv4Address = lib.mkOption {
      type = lib.types.str;
      default = "";
      description = "Reserved IPv4 address for public LoadBalancer services.";
    };

    ipv6Block = lib.mkOption {
      type = lib.types.str;
      default = "";
      description = "Reserved IPv6 /64 block for public LoadBalancer services (e.g. 2001:db8::/64).";
    };

    bgp = {
      enable = lib.mkEnableOption "BGP peering with upstream router (e.g. Vultr) for reserved IP announcement";

      myASN = lib.mkOption {
        type = lib.types.int;
        default = 64512;
        description = "Local (cluster-side) BGP ASN. Use a private ASN unless you have your own.";
      };

      peerASN = lib.mkOption {
        type = lib.types.int;
        description = "Upstream router BGP ASN (e.g. Vultr account ASN).";
      };

      peerAddress = lib.mkOption {
        type = lib.types.str;
        default = "169.254.1.1";
        description = "IPv4 BGP peer address (upstream router). 169.254.1.1 for Vultr bare metal, 169.254.169.254 for Vultr VMs.";
      };

      peerAddressIPv6 = lib.mkOption {
        type = lib.types.str;
        default = "2001:19f0:ffff::1";
        description = "IPv6 BGP peer address (upstream router).";
      };

      password = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "BGP TCP MD5 authentication password.";
      };

      sourceAddress = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "Source IPv4 address for BGP peering (node's public IP).";
      };

      sourceAddressIPv6 = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "Source IPv6 address for BGP peering (node's SLAAC address).";
      };
    };

    controllerImage = lib.mkOption {
      type = lib.types.str;
      description = "Nix store path to the controller OCI image.";
    };

    hostAgentImage = lib.mkOption {
      type = lib.types.str;
      description = "Nix store path to the host agent OCI image.";
    };

    builderImage = lib.mkOption {
      type = lib.types.str;
      default = "";
      description = "Nix image ref for builder Job pods. Empty = controller runs nix directly.";
    };

    swtpmEnabled = lib.mkOption {
      type = lib.types.bool;
      default = true;
      description = "Enable vTPM (swtpm) for all instances via SeedHostTask CRDs.";
    };

    registrar = {
      apiKeyFile = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "Path to file containing the NameSilo API key for domain registration.";
      };
    };

    dns = {
      apiUrl = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "PowerDNS HTTP API URL for DNS auto-registration. Empty = disabled.";
      };

      apiKeyFile = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "Path to file containing the PowerDNS API key.";
      };

      zone = lib.mkOption {
        type = lib.types.str;
        default = "loom.farm.";
        description = "PowerDNS zone name (for API calls).";
      };

      instanceDomain = lib.mkOption {
        type = lib.types.str;
        default = "seed.loom.farm";
        description = "Domain suffix for instance FQDNs (<instance>.<namespace>.<instanceDomain>).";
      };
    };

    acme = {
      accountKey = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = ''
          Base64-encoded Let's Encrypt account key PEM. Stored as base64 in
          sops to avoid multi-line values breaking JSON templates. The value
          is placed in a k8s Secret `data` field (which expects base64),
          rendered by sops.templates at activation time.
        '';
      };

      _secretManifestJSON = lib.mkOption {
        type = lib.types.str;
        internal = true;
        default = "";
        description = "Generated k8s Secret JSON for sops.templates wiring.";
      };
    };

    netpol = {
      enable = lib.mkEnableOption "Network policy enforcement via iptables in host-agent";
    };

    webhook = {
      enable = lib.mkEnableOption "Seed webhook for cache-busting reconciliation";

      port = lib.mkOption {
        type = lib.types.port;
        default = 9876;
        description = "Port for the webhook HTTP listener.";
      };

      secretFile = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = ''
          Path to file containing the HMAC-SHA256 secret for GitHub webhook verification.
          Empty = no authentication (accept all requests).
        '';
      };
    };

    siloHost = lib.mkOption {
      type = lib.types.str;
      default = "silo.loom.farm";
      description = "Hostname of the silo git server, used to expand silo: shorthand in plant command.";
    };

    poolManager = {
      enable = lib.mkEnableOption "Pool manager for hardware-isolated nix eval/build";

      poolSize = lib.mkOption {
        type = lib.types.int;
        default = 2;
        description = "Number of warm VM slots per node.";
      };

      port = lib.mkOption {
        type = lib.types.port;
        default = 9877;
        description = "Port for the pool manager HTTP API.";
      };

      image = lib.mkOption {
        type = lib.types.str;
        default = "";
        description = "Nix store path to the pool manager OCI image.";
      };
    };
  };

  config = lib.mkIf cfg.enable {
    # Deploy controller manifests via kubectl apply on activation
    seed.k8s.services.seed-controller.manifests = controllerManifests;

    # Expose ACME secret JSON for sops.templates wiring in infra profiles
    seed.controller.acme._secretManifestJSON = lib.mkIf (cfg.acme.accountKey != "") acmeSecretJSON;
  };
}