apiVersion: v1
kind: ConfigMap
metadata:
  name: pixelfed-env
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/part-of: pixelfed
data:
{{- range $key, $value := .Values.config }}
  {{ $key }}: {{ $value | quote }}
{{- end }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: pixelfed-filesystem-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/part-of: pixelfed
data:
  filesystems.php: |-
    <?php

    return [
        'default' => env('DANGEROUSLY_SET_FILESYSTEM_DRIVER', 'local'),
        'cloud' => env('FILESYSTEM_CLOUD', 's3'),
        'disks' => [
            'local' => [
                'driver' => 'local',
                'root' => storage_path('app'),
                'permissions' => [
                    'file' => ['public' => 0644, 'private' => 0640],
                    'dir' => ['public' => 0755, 'private' => 0750],
                ],
                'serve' => true,
                'throw' => false,
                'report' => false,
            ],
            'public' => [
                'driver' => 'local',
                'root' => storage_path('app/public'),
                'url' => env('APP_URL').'/storage',
                'visibility' => 'public',
                'throw' => true,
                'report' => false,
            ],
            's3' => [
                'driver' => 's3',
                'key' => env('AWS_ACCESS_KEY_ID'),
                'secret' => env('AWS_SECRET_ACCESS_KEY'),
                'region' => env('AWS_DEFAULT_REGION'),
                'bucket' => env('AWS_BUCKET'),
                'visibility' => env('AWS_VISIBILITY', 'public'),
                'url' => env('AWS_URL'),
                'endpoint' => env('AWS_ENDPOINT'),
                'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
                'throw' => true,
                'options' => [
                    'request_checksum_calculation' => env('AWS_REQUEST_CHECKSUM_CALCULATION', 'WHEN_SUPPORTED'),
                    'response_checksum_validation' => env('AWS_RESPONSE_CHECKSUM_VALIDATION', 'WHEN_SUPPORTED'),
                    'StorageClass' => env('AWS_STORAGE_CLASS', 'STANDARD'),
                ],
                'report' => false,
            ],
            'alt-primary' => [
                'enabled' => env('ALT_PRI_ENABLED', false),
                'driver' => 's3',
                'key' => env('ALT_PRI_AWS_ACCESS_KEY_ID'),
                'secret' => env('ALT_PRI_AWS_SECRET_ACCESS_KEY'),
                'region' => env('ALT_PRI_AWS_DEFAULT_REGION'),
                'bucket' => env('ALT_PRI_AWS_BUCKET'),
                'visibility' => 'public',
                'url' => env('ALT_PRI_AWS_URL'),
                'endpoint' => env('ALT_PRI_AWS_ENDPOINT'),
                'use_path_style_endpoint' => env('ALT_PRI_AWS_USE_PATH_STYLE_ENDPOINT', false),
                'throw' => true,
            ],
            'alt-secondary' => [
                'enabled' => env('ALT_SEC_ENABLED', false),
                'driver' => 's3',
                'key' => env('ALT_SEC_AWS_ACCESS_KEY_ID'),
                'secret' => env('ALT_SEC_AWS_SECRET_ACCESS_KEY'),
                'region' => env('ALT_SEC_AWS_DEFAULT_REGION'),
                'bucket' => env('ALT_SEC_AWS_BUCKET'),
                'visibility' => 'public',
                'url' => env('ALT_SEC_AWS_URL'),
                'endpoint' => env('ALT_SEC_AWS_ENDPOINT'),
                'use_path_style_endpoint' => env('ALT_SEC_AWS_USE_PATH_STYLE_ENDPOINT', false),
                'throw' => true,
            ],
            'spaces' => [
                'driver' => 's3',
                'key' => env('DO_SPACES_KEY'),
                'secret' => env('DO_SPACES_SECRET'),
                'endpoint' => env('DO_SPACES_ENDPOINT'),
                'region' => env('DO_SPACES_REGION'),
                'bucket' => env('DO_SPACES_BUCKET'),
                'visibility' => 'public',
                'options' => ['CacheControl' => 'max-age=31536000'],
                'root' => env('DO_SPACES_ROOT', ''),
                'throw' => true,
                'url' => env('AWS_URL'),
            ],
            'backup' => [
                'driver' => env('PF_BACKUP_DRIVER', 's3'),
                'visibility' => 'private',
                'root' => env('PF_BACKUP_DRIVER', 'local') == 'local'
                    ? storage_path('app/backups/') : env('PF_BACKUP_ROOT', '/'),
                'key' => env('PF_BACKUP_KEY'),
                'secret' => env('PF_BACKUP_SECRET'),
                'endpoint' => env('PF_BACKUP_ENDPOINT'),
                'region' => env('PF_BACKUP_REGION'),
                'bucket' => env('PF_BACKUP_BUCKET'),
            ],
        ],
    ];
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pixelfed-web
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: pixelfed-web
    app.kubernetes.io/part-of: pixelfed
spec:
  replicas: {{ .Values.replicas.web }}
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: pixelfed-web
      app.kubernetes.io/part-of: pixelfed
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pixelfed-web
        app.kubernetes.io/part-of: pixelfed
    spec:
      securityContext:
        fsGroup: 33
        fsGroupChangePolicy: OnRootMismatch
      initContainers:
        - name: initialize-app-data
          image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -ec
            - >-
              mkdir -p /data/storage /data/bootstrap-cache &&
              cp -rn /var/www/html/storage/. /data/storage/ &&
              find /data/bootstrap-cache -mindepth 1 -maxdepth 1 -type f -delete &&
              cp -rn /var/www/html/bootstrap/cache/. /data/bootstrap-cache/ &&
              chown -R 33:33 /data
          securityContext:
            runAsUser: 0
            runAsGroup: 0
          volumeMounts:
            - name: app-data
              mountPath: /data
      containers:
        - name: pixelfed
          image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          envFrom:
            - configMapRef:
                name: pixelfed-env
            - secretRef:
                name: {{ .Values.runtimeSecret }}
          env:
            - name: AUTORUN_ENABLED
              value: "true"
            # The installer runs migrations explicitly while Horizon and the
            # scheduler are stopped, avoiding mixed-schema background jobs.
            - name: AUTORUN_LARAVEL_MIGRATION
              value: "false"
            - name: AUTORUN_LARAVEL_STORAGE_LINK
              value: "true"
            - name: AUTORUN_LARAVEL_EVENT_CACHE
              value: "true"
            - name: AUTORUN_LARAVEL_ROUTE_CACHE
              value: "true"
            - name: AUTORUN_LARAVEL_VIEW_CACHE
              value: "true"
            - name: AUTORUN_LARAVEL_CONFIG_CACHE
              value: "true"
          startupProbe:
            httpGet:
              path: /api/service/health-check
              port: http
              scheme: HTTP
            # A first install can spend well over ten minutes applying the
            # historical Pixelfed schema on networked storage.
            failureThreshold: 360
            periodSeconds: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /api/service/health-check
              port: http
              scheme: HTTP
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /api/service/health-check
              port: http
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 5
          resources:
            requests:
              cpu: 300m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 2Gi
          volumeMounts:
            - name: filesystem-config
              mountPath: /var/www/html/config/filesystems.php
              subPath: filesystems.php
              readOnly: true
            - name: app-data
              mountPath: /var/www/html/storage
              subPath: storage
            - name: app-data
              mountPath: /var/www/html/bootstrap/cache
              subPath: bootstrap-cache
      volumes:
        - name: filesystem-config
          configMap:
            name: pixelfed-filesystem-config
        - name: app-data
          persistentVolumeClaim:
            claimName: app-data
---
apiVersion: v1
kind: Service
metadata:
  name: pixelfed-web
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: pixelfed-web
    app.kubernetes.io/part-of: pixelfed
spec:
  selector:
    app.kubernetes.io/name: pixelfed-web
    app.kubernetes.io/part-of: pixelfed
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pixelfed-horizon
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: pixelfed-horizon
    app.kubernetes.io/part-of: pixelfed
spec:
  # install-pixelfed.sh raises this to one only after migrations finish.
  replicas: {{ .Values.replicas.horizon }}
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: pixelfed-horizon
      app.kubernetes.io/part-of: pixelfed
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pixelfed-horizon
        app.kubernetes.io/part-of: pixelfed
    spec:
      securityContext:
        fsGroup: 33
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: horizon
          image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
          imagePullPolicy: IfNotPresent
          command:
            - php
            - artisan
            - horizon
          envFrom:
            - configMapRef:
                name: pixelfed-env
            - secretRef:
                name: {{ .Values.runtimeSecret }}
          env:
            - name: AUTORUN_ENABLED
              value: "false"
          resources:
            requests:
              cpu: 200m
              memory: 384Mi
            limits:
              cpu: "2"
              memory: 2Gi
          volumeMounts:
            - name: filesystem-config
              mountPath: /var/www/html/config/filesystems.php
              subPath: filesystems.php
              readOnly: true
            - name: app-data
              mountPath: /var/www/html/storage
              subPath: storage
            - name: app-data
              mountPath: /var/www/html/bootstrap/cache
              subPath: bootstrap-cache
      volumes:
        - name: filesystem-config
          configMap:
            name: pixelfed-filesystem-config
        - name: app-data
          persistentVolumeClaim:
            claimName: app-data
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: pixelfed-scheduler
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: pixelfed-scheduler
    app.kubernetes.io/part-of: pixelfed
spec:
  schedule: "* * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 300
      template:
        metadata:
          labels:
            app.kubernetes.io/name: pixelfed-scheduler
            app.kubernetes.io/part-of: pixelfed
        spec:
          restartPolicy: OnFailure
          securityContext:
            fsGroup: 33
            fsGroupChangePolicy: OnRootMismatch
          containers:
            - name: scheduler
              image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
              imagePullPolicy: IfNotPresent
              command:
                - php
                - artisan
                - schedule:run
              envFrom:
                - configMapRef:
                    name: pixelfed-env
                - secretRef:
                    name: {{ .Values.runtimeSecret }}
              env:
                - name: AUTORUN_ENABLED
                  value: "false"
              resources:
                requests:
                  cpu: 50m
                  memory: 128Mi
                limits:
                  cpu: "1"
                  memory: 1Gi
              volumeMounts:
                - name: filesystem-config
                  mountPath: /var/www/html/config/filesystems.php
                  subPath: filesystems.php
                  readOnly: true
                - name: app-data
                  mountPath: /var/www/html/storage
                  subPath: storage
                - name: app-data
                  mountPath: /var/www/html/bootstrap/cache
                  subPath: bootstrap-cache
          volumes:
            - name: filesystem-config
              configMap:
                name: pixelfed-filesystem-config
            - name: app-data
              persistentVolumeClaim:
                claimName: app-data
{{- if .Values.ingress.enabled }}
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: {{ .Values.ingress.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/part-of: pixelfed
spec:
  entryPoints:
    - {{ .Values.ingress.entryPoint }}
  routes:
    - kind: Rule
      match: Host(`{{ .Values.domain }}`)
      services:
        - name: pixelfed-web
          port: 80
  tls: {}
{{- end }}