ALTER TABLE managed_instances
ADD COLUMN proxy_protocol TEXT NOT NULL DEFAULT 'socks5'
    CHECK (proxy_protocol IN ('socks5', 'http'));

ALTER TABLE managed_instances
ADD COLUMN proxy_auth_configured INTEGER NOT NULL DEFAULT 0
    CHECK (proxy_auth_configured IN (0, 1));

ALTER TABLE managed_instances
ADD COLUMN cloudflare_proxied INTEGER NOT NULL DEFAULT 0
    CHECK (cloudflare_proxied IN (0, 1));

ALTER TABLE fleet_run_items
ADD COLUMN proxy_protocol TEXT NOT NULL DEFAULT 'socks5'
    CHECK (proxy_protocol IN ('socks5', 'http'));

ALTER TABLE fleet_run_items
ADD COLUMN cloudflare_proxied INTEGER NOT NULL DEFAULT 0
    CHECK (cloudflare_proxied IN (0, 1));

CREATE TABLE managed_instance_secrets (
    instance_id TEXT NOT NULL
        REFERENCES managed_instances(id) ON DELETE CASCADE,
    name TEXT NOT NULL CHECK (name IN ('proxy_username', 'proxy_password')),
    key_version INTEGER NOT NULL DEFAULT 1 CHECK (key_version > 0),
    nonce TEXT NOT NULL,
    ciphertext TEXT NOT NULL,
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL,
    PRIMARY KEY (instance_id, name)
);

CREATE INDEX idx_managed_instance_secrets_instance
ON managed_instance_secrets(instance_id);