{{- if not (or .Values.postgresql.enabled .Values.database.existingSecret .Values.database.url) }}
{{- fail "Set database.url, database.existingSecret or postgresql.enabled" }}
{{- end }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "archify-sync.fullname" . }}
  labels:
    {{- include "archify-sync.labels" . | nindent 4 }}
    {{- include "archify-sync.selector" . | nindent 4 }}
spec:
  # One server holds the live copy of each space; see values.yaml.
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      {{- include "archify-sync.selector" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "archify-sync.labels" . | nindent 8 }}
        {{- include "archify-sync.selector" . | nindent 8 }}
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      automountServiceAccountToken: false
      # Leaving stores a snapshot of every open space.
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: server
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          ports:
            - name: http
              containerPort: 8080
            {{- if .Values.metrics.enabled }}
            - name: metrics
              containerPort: {{ .Values.metrics.port }}
            {{- end }}
          env:
            - name: ARCHIFY_SYNC_DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ include "archify-sync.dbSecret" . }}
                  key: {{ include "archify-sync.dbSecretKey" . }}
            - name: ARCHIFY_SYNC_DATABASE_MAX_CONNECTIONS
              value: {{ .Values.database.maxConnections | quote }}
            - name: ARCHIFY_SYNC_LISTEN
              value: "0.0.0.0:8080"
            - name: ARCHIFY_SYNC_PUBLIC_URL
              value: {{ .Values.publicUrl | quote }}
            - name: ARCHIFY_SYNC_NAME
              value: {{ .Values.config.name | quote }}
            - name: ARCHIFY_SYNC_SNAPSHOT_IDLE_SECS
              value: {{ .Values.config.snapshotIdleSecs | quote }}
            - name: ARCHIFY_SYNC_SNAPSHOT_MAX_SECS
              value: {{ .Values.config.snapshotMaxSecs | quote }}
            - name: ARCHIFY_SYNC_SNAPSHOT_MAX_EDITS
              value: {{ .Values.config.snapshotMaxEdits | quote }}
            - name: ARCHIFY_SYNC_INVITE_HOURS
              value: {{ .Values.config.inviteHours | quote }}
            - name: ARCHIFY_SYNC_MEMBERS_CAN_INVITE
              value: {{ .Values.config.membersCanInvite | quote }}
            - name: ARCHIFY_SYNC_ACCESS_TTL_SECS
              value: {{ .Values.config.accessTtlSecs | quote }}
            - name: ARCHIFY_SYNC_REFRESH_TTL_DAYS
              value: {{ .Values.config.refreshTtlDays | quote }}
            - name: ARCHIFY_SYNC_REFRESH_GRACE_SECS
              value: {{ .Values.config.refreshGraceSecs | quote }}
            - name: ARCHIFY_SYNC_REDIRECT_SCHEMES
              value: {{ .Values.config.redirectSchemes | quote }}
            - name: ARCHIFY_SYNC_MAX_MESSAGE_BYTES
              value: {{ .Values.config.maxMessageBytes | int64 | quote }}
            - name: ARCHIFY_SYNC_LOG_JSON
              value: {{ .Values.config.logJson | quote }}
            {{- if .Values.metrics.enabled }}
            - name: ARCHIFY_SYNC_METRICS_LISTEN
              value: "0.0.0.0:{{ .Values.metrics.port }}"
            {{- end }}
            {{- with .Values.oidc }}
            {{- if .enabled }}
            - name: ARCHIFY_SYNC_OIDC_ISSUER
              value: {{ required "oidc.issuer is required when oidc.enabled" .issuer | quote }}
            - name: ARCHIFY_SYNC_OIDC_CLIENT_ID
              value: {{ .clientId | quote }}
            {{- if .existingSecret }}
            - name: ARCHIFY_SYNC_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .existingSecret }}
                  key: {{ .existingSecretKey }}
            {{- end }}
            - name: ARCHIFY_SYNC_OIDC_LABEL
              value: {{ .label | quote }}
            - name: ARCHIFY_SYNC_OIDC_SCOPES
              value: {{ .scopes | quote }}
            - name: ARCHIFY_SYNC_OIDC_GROUPS_CLAIM
              value: {{ .groupsClaim | quote }}
            - name: ARCHIFY_SYNC_OIDC_ALLOWED_GROUPS
              value: {{ join "," .allowedGroups | quote }}
            - name: ARCHIFY_SYNC_OIDC_ADMIN_GROUPS
              value: {{ join "," .adminGroups | quote }}
            {{- end }}
            {{- end }}
            - name: RUST_LOG
              value: {{ .Values.config.logLevel | quote }}
            {{- with .Values.extraEnv }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          startupProbe:
            httpGet: { path: /healthz, port: http }
            periodSeconds: 2
            failureThreshold: 60
          livenessProbe:
            httpGet: { path: /healthz, port: http }
            periodSeconds: 10
          readinessProbe:
            httpGet: { path: /readyz, port: http }
            periodSeconds: 5
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}