{% extends 'base/layout.html' %}
{% load form_helpers %}
{% load i18n %}
{% load proxbox_tags %}

{% block title %}{% trans "Proxbox Settings" %}{% endblock %}

{% block content %}
<div class="row">
    <div class="col col-md-12">
        <h4 class="mb-3">{% trans "Plugin Settings" %}</h4>
        <form method="post">
            {% csrf_token %}
            {# Sync Settings Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-sync"></i>
                    {% trans "Sync Settings" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure runtime behavior for Proxbox synchronization.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.use_guest_agent_interface_name %}
                    {% render_field form.proxbox_fetch_max_concurrency %}
                    {% render_field form.ignore_ipv6_link_local_addresses %}
                    {% render_field form.ensure_netbox_objects %}
                    {% render_field form.delete_orphans %}
                    {% render_field form.primary_ip_preference %}
                    {% render_field form.parse_description_metadata %}
                    {% render_field form.embed_description_metadata %}
                    {% render_field form.default_role_qemu %}
                    {% render_field form.default_role_lxc %}
                    {% render_field form.backend_log_file_path %}
                </div>
            </div>
            {# NetBox Integration Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-database"></i>
                    {% trans "NetBox Integration" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure NetBox API connection behavior, caching, and bulk operation parameters.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.netbox_max_concurrent %}
                    {% render_field form.netbox_timeout %}
                    {% render_field form.netbox_write_concurrency %}
                    {% render_field form.proxmox_fetch_concurrency %}
                    {% render_field form.netbox_max_retries %}
                    {% render_field form.netbox_retry_delay %}
                    {% render_field form.netbox_get_cache_ttl %}
                    {% render_field form.netbox_get_cache_max_entries %}
                    {% render_field form.netbox_get_cache_max_bytes %}
                    {% render_field form.bulk_batch_size %}
                    {% render_field form.bulk_batch_delay_ms %}
                    {% render_field form.backup_batch_size %}
                    {% render_field form.backup_batch_delay_ms %}
                    {% render_field form.vm_sync_max_concurrency %}
                    {% render_field form.custom_fields_request_delay %}
                </div>
            </div>
            {# Sync Overwrite Behavior — one card per resource category #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-pencil-circle"></i>
                    {% trans "Sync Overwrite Behavior" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Control whether sync overwrites specific fields on existing NetBox objects.
                        These are the global defaults; individual Proxmox endpoints can override
                        each value from their Settings tab.
                        {% endblocktrans %}
                    </p>
                </div>
            </div>
            {% for group_label, group_fields in overwrite_field_groups %}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-pencil-circle-outline"></i>
                    {{ group_label }}
                </h5>
                <div class="card-body">
                    {% for field_name in group_fields %}
                        {% render_field form|form_field:field_name %}
                    {% endfor %}
                </div>
            </div>
            {% endfor %}
            {# Proxmox API Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-server"></i>
                    {% trans "Proxmox API" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure default timeout and retry behavior for Proxmox API requests.
                        Individual endpoints can override these values.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.proxmox_timeout %}
                    {% render_field form.proxmox_max_retries %}
                    {% render_field form.proxmox_retry_backoff %}
                </div>
            </div>
            {# SSRF Protection Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-shield-check"></i>
                    {% trans "SSRF Protection" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure Server-Side Request Forgery (SSRF) protection for endpoint validation.
                        Endpoints registered in the database are automatically allowed.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.ssrf_protection_enabled %}
                    {% render_field form.allow_private_ips %}
                    {% render_field form.additional_allowed_ip_ranges %}
                    {% render_field form.explicitly_blocked_ip_ranges %}
                </div>
            </div>
            {# Diagnostics Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-bug"></i>
                    {% trans "Diagnostics" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Toggle diagnostic logging and error-detail behavior on the proxbox-api service.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.debug_cache %}
                    {% render_field form.expose_internal_errors %}
                </div>
            </div>
            {# NetBox Branching Integration Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-source-branch"></i>
                    {% trans "NetBox Branching Integration" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Auto-create a NetBox branch per Proxbox sync job and merge it
                        back into main on success. Requires the netbox_branching
                        plugin to be installed and listed last in PLUGINS.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.branching_enabled %}
                    {% render_field form.branch_name_prefix %}
                    {% render_field form.branch_on_conflict %}
                    <hr>
                    <p class="text-danger">
                        <strong>
                            {% trans "NetBox → Proxmox intent direction (advanced)" %}
                        </strong>
                        <br>
                        {% blocktrans trimmed %}
                        Enabling these settings allows merging a NetBox branch flagged
                        apply_to_proxmox=True to dispatch CREATE / UPDATE writes to
                        Proxmox via proxbox-api. DELETE still requires a separate
                        DeletionRequest authorization chain. Off by default.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.netbox_to_proxmox_enabled %}
                    {% render_field form.netbox_to_proxmox_typed_confirmation %}
                    {% render_field form.intent_warn_plaintext_password %}
                    {% render_field form.apply_destroy_confirmed %}
                    {% render_field form.intent_apply_authorization_self_approve_allowed %}
                    {% render_field form.intent_deletion_request_ttl_days %}
                </div>
            </div>
            {# Hardware Discovery Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-server-network"></i>
                    {% trans "Hardware Discovery" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Enable the opt-in SSH discovery pass that reflects chassis and NIC
                        hardware facts onto NetBox custom fields during Proxmox sync.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.hardware_discovery_enabled %}
                </div>
            </div>
            {# Encryption Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-lock"></i>
                    {% trans "Encryption" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure credential encryption for proxbox-api. When enabled, sensitive
                        credentials are encrypted at rest using the key below. The encryption key
                        can also be set via the PROXBOX_ENCRYPTION_KEY environment variable on the
                        proxbox-api host.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.encryption_enabled %}
                    {% render_field form.encryption_key %}
                </div>
            </div>
            <div class="mb-3">
                <button type="submit" class="btn btn-primary">
                    <i class="mdi mdi-content-save"></i>
                    {% trans "Save Settings" %}
                </button>
            </div>
        </form>
    </div>
</div>
{% endblock %}