package PVE::API2::Cluster;

use strict;
use warnings;

use JSON;

use PVE::API2Tools;
use PVE::Cluster qw(cfs_register_file cfs_lock_file cfs_read_file cfs_write_file);
use PVE::DataCenterConfig;
use PVE::Exception qw(raise_param_exc);
use PVE::Firewall;
use PVE::GuestHelpers;
use PVE::HA::Config;
use PVE::HA::Env::PVE2;
use PVE::INotify;
use PVE::JSONSchema qw(get_standard_option);
use PVE::RESTHandler;
use PVE::RPCEnvironment;
use PVE::SafeSyslog;
use PVE::Storage;
use PVE::Tools qw(extract_param);

use PVE::API2::ACMEAccount;
use PVE::API2::ACMEPlugin;
use PVE::API2::Backup;
use PVE::API2::Cluster::BackupInfo;
use PVE::API2::Cluster::Ceph;
use PVE::API2::Cluster::Mapping;
use PVE::API2::Cluster::Jobs;
use PVE::API2::Cluster::MetricServer;
use PVE::API2::Cluster::Notifications;
use PVE::API2::ClusterConfig;
use PVE::API2::Firewall::Cluster;
use PVE::API2::HAConfig;
use PVE::API2::ReplicationConfig;

my $have_sdn;
eval {
    require PVE::API2::Network::SDN;
    $have_sdn = 1;
};

use base qw(PVE::RESTHandler);

__PACKAGE__->register_method({
    subclass => "PVE::API2::ReplicationConfig",
    path => 'replication',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::MetricServer",
    path => 'metrics',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::Notifications",
    path => 'notifications',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::ClusterConfig",
    path => 'config',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Firewall::Cluster",
    path => 'firewall',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Backup",
    path => 'backup',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::BackupInfo",
    path => 'backup-info',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::HAConfig",
    path => 'ha',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::ACMEAccount",
    path => 'acme',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::Ceph",
    path => 'ceph',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::Jobs",
    path => 'jobs',
});

__PACKAGE__->register_method({
    subclass => "PVE::API2::Cluster::Mapping",
    path => 'mapping',
});

if ($have_sdn) {
    __PACKAGE__->register_method({
        subclass => "PVE::API2::Network::SDN",
        path => 'sdn',
    });
}

my $dc_schema = PVE::DataCenterConfig::get_datacenter_schema();
my $dc_properties = {
    delete => {
        type => 'string',
        format => 'pve-configid-list',
        description => "A list of settings you want to delete.",
        optional => 1,
    },
};
foreach my $opt (keys %{ $dc_schema->{properties} }) {
    $dc_properties->{$opt} = $dc_schema->{properties}->{$opt};
}

__PACKAGE__->register_method({
    name => 'index',
    path => '',
    method => 'GET',
    description => "Cluster index.",
    permissions => { user => 'all' },
    parameters => {
        additionalProperties => 0,
        properties => {},
    },
    returns => {
        type => 'array',
        items => {
            type => "object",
            properties => {},
        },
        links => [{ rel => 'child', href => "{name}" }],
    },
    code => sub {
        my ($param) = @_;

        my $result = [
            { name => 'acme' },
            { name => 'backup' },
            { name => 'backup-info' },
            { name => 'ceph' },
            { name => 'config' },
            { name => 'firewall' },
            { name => 'ha' },
            { name => 'jobs' },
            { name => 'log' },
            { name => 'mapping' },
            { name => 'metrics' },
            { name => 'notifications' },
            { name => 'nextid' },
            { name => 'options' },
            { name => 'replication' },
            { name => 'resources' },
            { name => 'status' },
            { name => 'tasks' },
        ];

        if ($have_sdn) {
            push(@{$result}, { name => 'sdn' });
        }

        return $result;
    },
});

__PACKAGE__->register_method({
    name => 'log',
    path => 'log',
    method => 'GET',
    description => "Read cluster log",
    permissions => { user => 'all' },
    parameters => {
        additionalProperties => 0,
        properties => {
            max => {
                type => 'integer',
                description => "Maximum number of entries.",
                optional => 1,
                minimum => 1,
            },
        },
    },
    returns => {
        type => 'array',
        items => {
            type => "object",
            properties => {},
        },
    },
    code => sub {
        my ($param) = @_;

        my $rpcenv = PVE::RPCEnvironment::get();

        my $max = $param->{max} || 0;
        my $user = $rpcenv->get_user();

        my $admin = $rpcenv->check($user, "/", ['Sys.Syslog'], 1);

        my $loguser = $admin ? '' : $user;

        my $res = decode_json(PVE::Cluster::get_cluster_log($loguser, $max));

        foreach my $entry (@{ $res->{data} }) {
            $entry->{id} = "$entry->{uid}:$entry->{node}";
        }

        return $res->{data};
    },
});

__PACKAGE__->register_method({
    name => 'resources',
    path => 'resources',
    method => 'GET',
    description => "Resources index (cluster wide).",
    permissions => { user => 'all' },
    parameters => {
        additionalProperties => 0,
        properties => {
            type => {
                type => 'string',
                description => 'Resource type.',
                optional => 1,
                enum => ['vm', 'storage', 'node', 'sdn'],
            },
        },
    },
    returns => {
        type => 'array',
        items => {
            type => "object",
            properties => {
                id => {
                    description => "Resource id.",
                    type => 'string',
                },
                type => {
                    description => "Resource type.",
                    type => 'string',
                    enum => ['node', 'storage', 'pool', 'qemu', 'lxc', 'openvz', 'sdn'],
                },
                status => {
                    description => "Resource type dependent status.",
                    type => 'string',
                    optional => 1,
                },
                name => {
                    description => "Name of the resource.",
                    type => 'string',
                    optional => 1,
                },
                node => get_standard_option(
                    'pve-node',
                    {
                        description => "The cluster node name"
                            . " (for types 'node', 'storage', 'qemu', and 'lxc').",
                        optional => 1,
                    },
                ),
                storage => get_standard_option(
                    'pve-storage-id',
                    {
                        description => "The storage identifier (for type 'storage').",
                        optional => 1,
                    },
                ),
                pool => {
                    description => "The pool name (for types 'pool', 'qemu' and 'lxc').",
                    type => 'string',
                    optional => 1,
                },
                cpu => {
                    description => "CPU utilization (for types 'node', 'qemu' and 'lxc').",
                    type => 'number',
                    optional => 1,
                    minimum => 0,
                    renderer => 'fraction_as_percentage',
                },
                maxcpu => {
                    description =>
                        "Number of available CPUs (for types 'node', 'qemu' and 'lxc').",
                    type => 'number',
                    optional => 1,
                    minimum => 0,
                },
                mem => {
                    description => "Used memory in bytes (for types 'node', 'qemu' and 'lxc').",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                    minimum => 0,
                },
                maxmem => {
                    description => "Number of available memory in bytes"
                        . " (for types 'node', 'qemu' and 'lxc').",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                },
                netin => {
                    description =>
                        "The amount of traffic in bytes that was sent to the guest over"
                        . " the network since it was started. (for types 'qemu' and 'lxc')",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                },
                netout => {
                    description => "The amount of traffic in bytes that was sent from the guest"
                        . " over the network since it was started. (for types 'qemu' and 'lxc')",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                },
                level => {
                    description => "Support level (for type 'node').",
                    type => 'string',
                    optional => 1,
                },
                lock => {
                    description =>
                        "The guest's current config lock (for types 'qemu' and 'lxc')",
                    type => 'string',
                    optional => 1,
                },
                uptime => {
                    description => "Uptime of node or virtual guest in seconds"
                        . " (for types 'node', 'qemu' and 'lxc').",
                    type => 'integer',
                    optional => 1,
                    renderer => 'duration',
                },
                hastate => {
                    description => "HA service status (for HA managed VMs).",
                    type => 'string',
                    optional => 1,
                },
                disk => {
                    description => "Used disk space in bytes (for type 'storage'),"
                        . " used root image space for VMs (for types 'qemu' and 'lxc').",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                    minimum => 0,
                },
                maxdisk => {
                    description => "Storage size in bytes (for type 'storage'),"
                        . " root image size for VMs (for types 'qemu' and 'lxc').",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                    minimum => 0,
                },
                diskread => {
                    description =>
                        "The amount of bytes the guest read from its block devices since"
                        . " the guest was started. This info is not available for all storage types."
                        . " (for types 'qemu' and 'lxc')",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                },
                diskwrite => {
                    description =>
                        "The amount of bytes the guest wrote to its block devices since"
                        . " the guest was started. This info is not available for all storage types."
                        . " (for types 'qemu' and 'lxc')",
                    type => 'integer',
                    optional => 1,
                    renderer => 'bytes',
                },
                content => {
                    description => "Allowed storage content types (for type 'storage').",
                    type => 'string',
                    format => 'pve-storage-content-list',
                    optional => 1,
                },
                plugintype => {
                    description => "More specific type, if available.",
                    type => 'string',
                    optional => 1,
                },
                vmid => get_standard_option(
                    'pve-vmid',
                    {
                        description => "The numerical vmid (for types 'qemu' and 'lxc').",
                        optional => 1,
                    },
                ),
                'cgroup-mode' => {
                    description => "The cgroup mode the node operates under (for type 'node').",
                    type => 'integer',
                    optional => 1,
                },
                tags => {
                    description => "The guest's tags (for types 'qemu' and 'lxc')",
                    type => "string",
                    optional => 1,
                },
                template => {
                    description => "Determines if the guest is a template."
                        . " (for types 'qemu' and 'lxc')",
                    type => 'boolean',
                    optional => 1,
                    default => 0,
                },
            },
        },
    },
    code => sub {
        my ($param) = @_;

        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
        my $usercfg = $rpcenv->{user_cfg};

        my $res = [];

        my $nodelist = PVE::Cluster::get_nodelist();
        my $members = PVE::Cluster::get_members();

        my $rrd = PVE::Cluster::rrd_dump();

        my $vmlist = PVE::Cluster::get_vmlist() || {};
        my $idlist = $vmlist->{ids} || {};

        my $hastatus = PVE::HA::Config::read_manager_status();
        my $haresources = PVE::HA::Config::read_resources_config();
        my $hatypemap = {
            'qemu' => 'vm',
            'lxc' => 'ct',
        };

        my $pooldata = {};
        if (!$param->{type} || $param->{type} eq 'pool') {
            for my $pool (sort keys %{ $usercfg->{pools} }) {
                my $d = $usercfg->{pools}->{$pool};

                next if !$rpcenv->check($authuser, "/pool/$pool", ['Pool.Audit'], 1);

                my $entry = {
                    id => "/pool/$pool",
                    pool => $pool,
                    type => 'pool',
                };

                $pooldata->{$pool} = $entry;

                push @$res, $entry;
            }
        }

        # we try to generate 'numbers' by using "$X + 0"
        if (!$param->{type} || $param->{type} eq 'vm') {
            my $prop_list = [qw(lock tags)];
            my $props = PVE::Cluster::get_guest_config_properties($prop_list);

            for my $vmid (sort keys %$idlist) {

                my $data = $idlist->{$vmid};
                my $entry = PVE::API2Tools::extract_vm_stats($vmid, $data, $rrd);

                if (my $pool = $usercfg->{vms}->{$vmid}) {
                    $entry->{pool} = $pool;
                    if (my $pe = $pooldata->{$pool}) {
                        if ($entry->{uptime}) {
                            $pe->{uptime} = $entry->{uptime}
                                if !$pe->{uptime} || $entry->{uptime} > $pe->{uptime};
                            $pe->{mem} = 0 if !$pe->{mem};
                            $pe->{mem} += $entry->{mem};
                            $pe->{maxmem} = 0 if !$pe->{maxmem};
                            $pe->{maxmem} += $entry->{maxmem};
                            $pe->{cpu} = 0 if !$pe->{cpu};
                            $pe->{maxcpu} = 0 if !$pe->{maxcpu};
                            # explanation:
                            # we do not know how much cpus there are in the cluster at this moment
                            # so we calculate the current % of the cpu
                            # but we had already the old cpu % before this vm, so:
                            # new% = (old%*oldmax + cur%*curmax) / (oldmax+curmax)
                            $pe->{cpu} =
                                (($pe->{cpu} * $pe->{maxcpu}) + ($entry->{cpu} * $entry->{maxcpu}))
                                / ($pe->{maxcpu} + $entry->{maxcpu});
                            $pe->{maxcpu} += $entry->{maxcpu};
                        }
                    }
                }

                # only skip now to next to ensure that the pool stats above are filled, if eligible
                next if !$rpcenv->check($authuser, "/vms/$vmid", ['VM.Audit'], 1);

                for my $prop (@$prop_list) {
                    if (defined(my $value = $props->{$vmid}->{$prop})) {
                        $entry->{$prop} = $value;
                    }
                }

                if (
                    defined($entry->{pool})
                    && !$rpcenv->check($authuser, "/pool/$entry->{pool}", ['Pool.Audit'], 1)
                ) {
                    delete $entry->{pool};
                }

                # get ha status
                if (my $hatype = $hatypemap->{ $entry->{type} }) {
                    my $sid = "$hatype:$vmid";
                    my $service;
                    if ($service = $hastatus->{service_status}->{$sid}) {
                        $entry->{hastate} = $service->{state};
                    } elsif ($service = $haresources->{ids}->{$sid}) {
                        $entry->{hastate} = $service->{state};
                    }
                }

                push @$res, $entry;
            }
        }

        my $static_node_info = PVE::Cluster::get_node_kv("static-info");

        if (!$param->{type} || $param->{type} eq 'node') {
            foreach my $node (@$nodelist) {
                my $can_audit = $rpcenv->check($authuser, "/nodes/$node", ['Sys.Audit'], 1);
                my $entry =
                    PVE::API2Tools::extract_node_stats($node, $members, $rrd, !$can_audit);

                my $info = eval { decode_json($static_node_info->{$node}); };
                if (defined(my $mode = $info->{'cgroup-mode'})) {
                    $entry->{'cgroup-mode'} = int($mode);
                }
                if (defined(my $status = $hastatus->{node_status}->{$node})) {
                    $entry->{'hastate'} = $status;
                }

                push @$res, $entry;
            }
        }

        if (!$param->{type} || $param->{type} eq 'storage') {

            my $cfg = PVE::Storage::config();
            my @sids = PVE::Storage::storage_ids($cfg);

            foreach my $storeid (@sids) {
                next if !$rpcenv->check($authuser, "/storage/$storeid", ['Datastore.Audit'], 1);

                my $scfg = PVE::Storage::storage_config($cfg, $storeid);
                # we create a entry for each node
                foreach my $node (@$nodelist) {
                    next if !PVE::Storage::storage_check_enabled($cfg, $storeid, $node, 1);

                    my $entry =
                        PVE::API2Tools::extract_storage_stats($storeid, $scfg, $node, $rrd);
                    push @$res, $entry;
                }
            }
        }

        if (!$param->{type} || $param->{type} eq 'sdn') {
            #add default "localnetwork" zone
            if ($rpcenv->check($authuser, "/sdn/zones/localnetwork", ['SDN.Audit'], 1)) {
                foreach my $node (@$nodelist) {
                    my $local_sdn = {
                        id => "sdn/$node/localnetwork",
                        sdn => 'localnetwork',
                        node => $node,
                        type => 'sdn',
                        status => 'ok',
                    };
                    push @$res, $local_sdn;
                }
            }

            if ($have_sdn) {
                my $nodes = PVE::Cluster::get_node_kv("sdn");

                for my $node (sort keys %{$nodes}) {
                    my $sdns = decode_json($nodes->{$node});

                    for my $id (sort keys %{$sdns}) {
                        next if !$rpcenv->check($authuser, "/sdn/zones/$id", ['SDN.Audit'], 1);
                        my $sdn = $sdns->{$id};
                        my $entry = {
                            id => "sdn/$node/$id",
                            sdn => $id,
                            node => $node,
                            type => 'sdn',
                            status => $sdn->{'status'},
                        };
                        push @$res, $entry;
                    }
                }
            }
        }

        return $res;
    },
});

__PACKAGE__->register_method({
    name => 'tasks',
    path => 'tasks',
    method => 'GET',
    description => "List recent tasks (cluster wide).",
    permissions => { user => 'all' },
    parameters => {
        additionalProperties => 0,
        properties => {},
    },
    returns => {
        type => 'array',
        items => {
            type => "object",
            properties => {
                upid => { type => 'string' },
            },
        },
    },
    code => sub {
        my ($param) = @_;

        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();

        my $tlist = PVE::Cluster::get_tasklist();
        return [] if !$tlist;

        my $all = $rpcenv->check($authuser, "/", ['Sys.Audit'], 1);

        my $res = [];
        foreach my $task (@$tlist) {
            if (PVE::AccessControl::pve_verify_tokenid($task->{user}, 1)) {
                ($task->{user}, $task->{tokenid}) =
                    PVE::AccessControl::split_tokenid($task->{user});
            }
            push @$res, $task if $all || ($task->{user} eq $authuser);
        }

        return $res;
    },
});

__PACKAGE__->register_method({
    name => 'get_options',
    path => 'options',
    method => 'GET',
    description =>
        "Get datacenter options. Without 'Sys.Audit' on '/' not all options are returned.",
    permissions => {
        user => 'all',
        check => ['perm', '/', ['Sys.Audit']],
    },
    parameters => {
        additionalProperties => 0,
        properties => {},
    },
    returns => {
        type => "object",
        properties => {},
    },
    code => sub {
        my ($param) = @_;

        my $res = {};

        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();

        my $datacenter_config = eval { PVE::Cluster::cfs_read_file('datacenter.cfg') } // {};

        if ($rpcenv->check($authuser, '/', ['Sys.Audit'], 1)) {
            $res = $datacenter_config;
        } else {
            for my $k (qw(console tag-style)) {
                $res->{$k} = $datacenter_config->{$k} if exists $datacenter_config->{$k};
            }
        }

        my $tags = PVE::GuestHelpers::get_allowed_tags($rpcenv, $authuser);
        $res->{'allowed-tags'} = [sort keys $tags->%*];

        return $res;
    },
});

__PACKAGE__->register_method({
    name => 'set_options',
    path => 'options',
    method => 'PUT',
    description => "Set datacenter options.",
    permissions => {
        check => ['perm', '/', ['Sys.Modify']],
    },
    protected => 1,
    parameters => {
        additionalProperties => 0,
        properties => $dc_properties,
    },
    returns => { type => "null" },
    code => sub {
        my ($param) = @_;

        my $delete = extract_param($param, 'delete');

        cfs_lock_file(
            'datacenter.cfg',
            undef,
            sub {
                my $conf = cfs_read_file('datacenter.cfg');

                $conf->{$_} = $param->{$_} for keys $param->%*;

                delete $conf->{$_} for PVE::Tools::split_list($delete);

                cfs_write_file('datacenter.cfg', $conf);
            },
        );
        die $@ if $@;

        return undef;
    },
});

__PACKAGE__->register_method({
    name => 'get_status',
    path => 'status',
    method => 'GET',
    description => "Get cluster status information.",
    permissions => {
        check => ['perm', '/', ['Sys.Audit']],
    },
    protected => 1,
    parameters => {
        additionalProperties => 0,
        properties => {},
    },
    returns => {
        type => 'array',
        items => {
            type => "object",
            properties => {
                type => {
                    type => 'string',
                    enum => ['cluster', 'node'],
                    description =>
                        'Indicates the type, either cluster or node. The type defines the object properties e.g. quorate available for type cluster.',
                },
                id => {
                    type => 'string',
                },
                name => {
                    type => 'string',
                },
                nodes => {
                    type => 'integer',
                    optional => 1,
                    description => '[cluster] Nodes count, including offline nodes.',
                },
                version => {
                    type => 'integer',
                    optional => 1,
                    description =>
                        '[cluster] Current version of the corosync configuration file.',
                },
                quorate => {
                    type => 'boolean',
                    optional => 1,
                    description =>
                        '[cluster] Indicates if there is a majority of nodes online to make decisions',
                },
                nodeid => {
                    type => 'integer',
                    optional => 1,
                    description => '[node] ID of the node from the corosync configuration.',
                },
                ip => {
                    type => 'string',
                    optional => 1,
                    description => '[node] IP of the resolved nodename.',
                },
                'local' => {
                    type => 'boolean',
                    optional => 1,
                    description => '[node] Indicates if this is the responding node.',
                },
                online => {
                    type => 'boolean',
                    optional => 1,
                    description => '[node] Indicates if the node is online or offline.',
                },
                level => {
                    type => 'string',
                    optional => 1,
                    description =>
                        '[node] Proxmox VE Subscription level, indicates if eligible for enterprise support as well as access to the stable Proxmox VE Enterprise Repository.',
                },
            },
        },
    },
    code => sub {
        my ($param) = @_;

        # make sure we get current info
        PVE::Cluster::cfs_update();

        # we also add info from pmxcfs
        my $clinfo = PVE::Cluster::get_clinfo();
        my $members = PVE::Cluster::get_members();
        my $nodename = PVE::INotify::nodename();
        my $rrd = PVE::Cluster::rrd_dump();

        if ($members) {
            my $res = [];

            if (my $d = $clinfo->{cluster}) {
                push @$res,
                    {
                        type => 'cluster',
                        id => 'cluster',
                        nodes => $d->{nodes},
                        version => $d->{version},
                        name => $d->{name},
                        quorate => $d->{quorate},
                    };
            }

            foreach my $node (keys %$members) {
                my $d = $members->{$node};
                my $entry = {
                    type => 'node',
                    id => "node/$node",
                    name => $node,
                    nodeid => $d->{id},
                    'local' => ($node eq $nodename) ? 1 : 0,
                    online => $d->{online},
                };

                if (defined($d->{ip})) {
                    $entry->{ip} = $d->{ip};
                }

                if (my $d = PVE::API2Tools::extract_node_stats($node, $members, $rrd)) {
                    $entry->{level} = $d->{level} || '';
                }

                push @$res, $entry;
            }
            return $res;
        } else {
            # fake entry for local node if no cluster defined
            my $pmxcfs = ($clinfo && $clinfo->{version}) ? 1 : 0; # pmxcfs online ?

            my $subinfo = PVE::API2::Subscription::read_etc_subscription();
            my $sublevel = $subinfo->{level} || '';

            return [{
                type => 'node',
                id => "node/$nodename",
                name => $nodename,
                ip => scalar(PVE::Cluster::remote_node_ip($nodename)),
                'local' => 1,
                nodeid => 0,
                online => 1,
                level => $sublevel,
            }];
        }
    },
});

__PACKAGE__->register_method({
    name => 'nextid',
    path => 'nextid',
    method => 'GET',
    description =>
        "Get next free VMID. Pass a VMID to assert that its free (at time of check).",
    permissions => { user => 'all' },
    parameters => {
        additionalProperties => 0,
        properties => {
            vmid => get_standard_option('pve-vmid', {
                    optional => 1,
            }),
        },
    },
    returns => {
        type => 'integer',
        description => "The next free VMID.",
    },
    code => sub {
        my ($param) = @_;

        my $vmlist = PVE::Cluster::get_vmlist() || {};
        my $idlist = $vmlist->{ids} || {};

        if (my $vmid = $param->{vmid}) {
            return $vmid if !defined($idlist->{$vmid});
            raise_param_exc({ vmid => "VM $vmid already exists" });
        }

        my $dc_conf = PVE::Cluster::cfs_read_file('datacenter.cfg');
        my $next_id = $dc_conf->{'next-id'} // {};

        my $lower = $next_id->{lower} // 100;
        my $upper = $next_id->{upper} // (1000 * 1000); # note, lower than the schema-maximum

        for (my $i = $lower; $i < $upper; $i++) {
            return $i if !defined($idlist->{$i});
        }

        die "unable to get any free VMID in range [$lower, $upper]\n";
    },
});

1;