var configSchema = environschema.Fields{
	"admin-secret": {
		Description: "The password for the administrator user",
		Type: environschema.Tstring,
		Secret: true,
		Example: "<random secret>",
	},
	config.AgentMetadataURLKey: {
		Description: "URL of private stream",
		Type:        environschema.Tstring,
	},
	config.AgentStreamKey: {
		// default: released
		Description: `Version of Juju to use for deploy/upgrades`,
		Type:        environschema.Tstring,
		Values: []interface{}{"released", "devel", "proposed"},
	},
	"agent-version": {
		Description: "The desired Juju agent version to use",
		Type: environschema.Tstring,
	},
	config.AllowLXCLoopMounts: {
		// default: false
		Description: `whether loop devices are allowed to be mounted inside lxc containers.`
		Type: environschema.Tbool,
	},
	"api-port": {
		// default: 17070
		Description: "The TCP port for the API servers to listen on",
		Type:        environschema.Tint,
	},
	config.AptFtpProxyKey: {
		// TODO document acceptable format
		Description: "The APT FTP proxy for the environment",
		Type:        environschema.Tstring,
	},
	config.AptHttpProxyKey: {
		// TODO document acceptable format
		Description: "The APT HTTP proxy for the environment",
		Type:        environschema.Tstring,
	},
	config.AptHttpsProxyKey: {
		// TODO document acceptable format
		Description: "The APT HTTPS proxy for the environment",
		Type:        environschema.Tstring,
	},
	"apt-mirror": {
		// TODO document acceptable format
		Description: "The APT mirror for the environment",
		Type: environschema.Tstring,
	},
	"authorized-keys": {
		// TODO what to do about authorized-keys-path ?
		Description: "Any authorized SSH public keys for the environment, as found in a ~/.ssh/authorized_keys file",
		Type:        environschema.Tstring,
	},
	config.PreventAllChangesKey: {
		Description: `Whether all changes to the environment will be prevented`,
		Type: environschema.Tbool,
	},
	config.PreventDestroyEnvironmentKey: {
		Description: `Whether the environment will be prevented from destruction`,
		Type: environschema.Tbool,
	},
	config.PreventRemoveObjectKey: {
		Description: `Whether remove operations (machine, service, unit or relation) will be prevented`,
		Type: environschema.Tbool,
	},
	"bootstrap-addresses-delay": {
		// default: 10s
		Description: "The amount of time between refreshing the addresses in seconds. Not too frequent as we refresh addresses from the provider each time.",
		Type:        environschema.Tint,
	},
	"bootstrap-retry-delay": {
		Description: "Time between attempts to connect to an address in seconds. Default is 5s",
		Type:        environschema.Tint,
	},
	"bootstrap-timeout": {
		Description: "The amount of time to wait contacting a state server in seconds (default 600s)",
		Type:        environschema.Tint,
	},
	"ca-cert": {
		// TODO what to do about ca-cert-path
		Description: `The certificate of the CA that signed the state server certificate, in PEM format`,
		Type: environschema.Tstring,
	},
	"ca-private-key": {
		// TODO what to do about ca-private-key-path
		Description: `The private key of the CA that signed the state server certificate, in PEM format`,
		Type: environschema.Tstring,
	},
	"default-series": {
		Description: "The default series of Ubuntu to use for deploying charms",
		Type:        environschema.Tstring,
	},
	"development": {
		// default: false
		Description: "Whether the environment is in development mode",
		Type:    environschema.Tbool,
	},
	"disable-network-management": {
		// default: false
		Description: "Whether the provider should control networks (on MAAS environments, set to true for MAAS to control networks",
		Type:        environschema.Tbool,
	},
	"enable-os-refresh-update": {
		// default: true
		Description: `Whether newly provisioned instances should run their respective OS's update capability.`,
		Type: environschema.Tbool,
	},
	"enable-os-upgrade": {
		// default: true
		Description: `Whether newly provisioned instances should run their respective OS's upgrade capability.`,
		Type: environschema.Tbool,
	},
	"firewall-mode": {
		Description: `The mode to use for network firewalling.

'instance' requests the use of an individual firewall per instance.

'global' uses a single firewall for all instances (access
for a network port is enabled to one instance if any instance requires
that port).

'none' requests that no firewalling should be performed
inside the environment. It's useful for clouds without support for either
global or per instance security groups.`,
		Type:        environschema.Tstring,
		Default:     "instance",
		Values: []interface{}{config.FwInstance, config.FwGlobal, config.FwNone},
	},
	config.FtpProxyKey: {
		Description: "The FTP proxy value to configure on instances, in the FTP_PROXY environment variable",
		Type:        environschema.Tstring,
	},
	config.HttpProxyKey: {
		Description: "The HTTP proxy value to configure on instances, in the HTTP_PROXY environment variable",
		Type:        environschema.Tstring,
	},
	config.HttpsProxyKey: {
		Description: "The HTTPS proxy value to configure on instances, in the HTTPS_PROXY environment variable",
		Type:        environschema.Tstring,
	},
	"image-metadata-url": {
		Description: "The URL at which the metadata used to locate OS image ids is located",
		Type: environschema.Tstring,
	},
	"image-stream": {
		Description: `The simplestreams stream used to identify which image ids to search when starting an instance.`,
		Type: environschema.Tstring,
	},
	"logging-config": {
		Description: `The configuration string to use when configuring Juju agent logging (see http://godoc.org/github.com/juju/loggo#ParseConfigurationString for details)`,
		Type: environschema.Tstring,
	},
	config.LxcClone: {
		Description: "Whether to use lxc-clone to create new LXC containers",
		Type: environschema.Tbool,
	},
	"lxc-clone-aufs": {
		// default: false
		Description: `Whether the LXC provisioner should creat an LXC clone using AUFS if available`,
		Type: environschema.Tbool,
	},
	config.LXCDefaultMTU: {
		// default: the default MTU setting for the container
		Description: `The MTU setting to use for network interfaces in LXC containers`,
		// TODO description
		Type: environschema.Tint,
	},
	config.LxcUseClone: {
		Description: `Whether the LXC provisioner should create a template and use cloning to speed up container provisioning. (deprecated by lxc-clone)`,
		Type: environschema.Tbool,
	},
	"name": {
		Description: "The name of the current environment",
		Type:        environschema.Tstring,
		Mandatory: true,
	},
	config.NoProxyKey: {
		Description: "List of domain addresses not to be proxied (comma-separated)",
		Type:        environschema.Tstring,
	},
	"prefer-ipv6": {
		// default: false
		Description: `Whether to prefer IPv6 over IPv4 addresses for API endpoints and machines`,
		Type:    environschema.Tbool,
	},
	config.ProvisionerHarvestModeKey: {
		// default: destroyed, but also depends on current setting of ProvisionerSafeModeKey
		Description: "What to do with unknown machines. See https://jujucharms.com/docs/stable/config-general#juju-lifecycle-and-harvesting (default destroyed)",
		Type:    environschema.Tstring,
		Values: []interface{}{"all", "none", "unknown", "destroyed"},
	},
	config.ProvisionerSafeModeKey: {
		Description: "Whether to run the provisioner in "destroyed" harvest mode (deprecated, superceded by provisioner-harvest-mode)`,
		Type: environschema.Tbool,
	},
	"proxy-ssh": {
		// default: true
		Description: `Whether SSH commands should be proxied through the API server`,
		Type:    environschema.Tbool,
	},
	"rsyslog-ca-cert": {
		Description: `The certificate of the CA that signed the rsyslog certificate, in PEM format.`,
		Type: environschema.Tstring,
	},
	"rsyslog-ca-key": {
		Description: `The private key of the CA that signed the rsyslog certificate, in PEM format`,
		Type: environschema.Tstring,
	},
	config.SetNumaControlPolicyKey: {
		Description: "Tune Juju state-server to work with NUMA if present (default false)",
		Type:        environschema.Tbool,
	},
	"ssl-hostname-verification": {
		Description: "Whether SSL hostname verification is enabled (default true)",
		Type:    environschema.Tbool,
	},
	"state-port": {
		// default: 37017
		Description: "Port for the API server to listen on.",
		Type:        environschema.Tint,
	},
	"syslog-port": {
		// default: 6514
		Description: "Port for the syslog UDP/TCP listener to listen on.",
		Type:        environschema.Tint,
	},
	"test-mode": {
		Description: `Whether the environment is intended for testing.
If true, accessing the charm store does not affect statistical
data of the store. (default false)`,
		Type: environschema.Tbool,
	},
	config.ToolsMetadataURLKey: {
		Description: `deprecated, superceded by agent-metadata-url`
		Type: environschema.Tstring,
	},
	config.ToolsStreamKey: {
		Description: `deprecated, superceded by agent-stream`
		Type: environschema.Tstring,
	},
	"type": {
		Description: "Type of environment, e.g. local, ec2",
		Type:        environschema.Tstring,
		Mandatory: true,
	},
	"uuid": {
		Description: "The UUID of the environment",
		Type: environschema.Tstring,
	},
}