apiVersion: apps/v1
kind: Deployment
metadata:
  name: "{{ .Release.Name }}-flame-hub-server-core"
  labels:
    app: "{{ .Release.Name }}-flame-hub-server-core"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: "{{ .Release.Name }}-flame-hub-server-core"
  template:
    metadata:
      name: "{{ .Release.Name }}-flame-hub-server-core"
      labels:
        app: "{{ .Release.Name }}-flame-hub-server-core"
        appGroup: "{{ .Release.Name }}-flame-hub"
    spec:
      restartPolicy: Always
      {{- if and (include "flameHub.harborProxy.enabled" .) (include "harbor.host" .) }}
      # Local-dev only (harborProxy.enabled): route Harbor's public hostname to the socat sidecar.
      hostAliases:
        - ip: "127.0.0.1"
          hostnames:
            - {{ include "harbor.host" . | quote }}
      {{- end }}
      initContainers:
          -   name: wait-for-db
              image: busybox
              command: [
                  'sh',
                  '-c',
                  'until nc -z -v -w30 {{ include "flameHub.postgresql.host" . }} 5432; do echo "Waiting for db..."; sleep 5; done'
              ]
          -   name: wait-for-redis
              image: busybox
              command: [
                  'sh',
                  '-c',
                  'until nc -z -v -w30 {{ include "flameHub.redis.host" . }} {{ .Values.redis.service.port }}; do echo "Waiting for redis..."; sleep 5; done'
              ]
          -   name: wait-for-rabbitmq
              image: busybox
              command: [
                  'sh',
                  '-c',
                  'until nc -z -v -w30 {{ .Release.Name }}-rabbitmq 5672; do echo "Waiting for rabbitmq..."; sleep 5; done'
              ]
          -   name: wait-for-authup
              image: busybox
              command: [
                  'sh',
                  '-c',
                  'until nc -z -v -w30 {{ .Release.Name }}-authup-server-core 3000; do echo "Waiting for authup..."; sleep 5; done'
              ]
          {{- if include "harbor.internalHost" . }}
          -   name: wait-for-harbor
              image: busybox
              command: [
                'sh',
                '-c',
                'until wget --no-check-certificate -qO- https://{{ include "harbor.internalHost" . }}/api/v2.0/ping; do echo "Waiting for harbor..."; sleep 5; done'
              ]
          {{- end }}
      containers:
        - name: "{{ .Release.Name }}-flame-hub-server-core"
          image: {{ include "flameHub.image" . | trim | quote }}
          args: ["core", "cli", "start"]
          imagePullPolicy: {{ .Values.image.pullPolicy | trim | quote }}
          ports:
            - containerPort: 3000
              protocol: TCP
          env:
              -   name: REDIS_CONNECTION_STRING
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.effectiveSecretName" .  }}
                          key: redis-connection-string
              -   name: RABBITMQ_CONNECTION_STRING
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.effectiveSecretName" .  }}
                          key: rabbitmq-connection-string
              -   name: AUTHUP_URL
                  value: "http://{{ .Release.Name }}-authup-server-core:3000/"
              -   name: TELEMETRY_URL
                  value: "http://{{ .Release.Name }}-flame-hub-server-telemetry:3000/"
              -   name: PUBLIC_URL
                  value: {{ include "serverCore.publicURL" . | trim | quote }}
              -   name: SKIP_PROJECT_APPROVAL
                  value: "true"
              -   name: SKIP_ANALYSIS_APPROVAL
                  value: "true"
              -   name: DB_TYPE
                  value: "postgres"
              -   name: DB_HOST
                  value: {{ include "flameHub.postgresql.host" . | quote }}
              -   name: DB_USERNAME
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.postgresql.secretName" . }}
                          key: username
              -   name: DB_PASSWORD
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.postgresql.secretName" . }}
                          key: password
              -   name: DB_DATABASE
                  value: "core"
              -   name: MASTER_IMAGES_BRANCH
                  value: {{ .Values.serverCore.env.masterImagesBranch | default "master" | quote }}
              {{- if include "harbor.host" . }}
              -   name: HARBOR_URL
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.harbor.secretName" .  }}
                          key: harbor-connection-string
              {{- end }}
              -   name: CLIENT_ID
                  value: "system"
              -   name: CLIENT_SECRET
                  valueFrom:
                      secretKeyRef:
                          name: {{ include "flameHub.effectiveSecretName" .  }}
                          key: authup-client-secret
              -   name: REALM
                  value: "master"
          resources:
              requests:
                  memory: "512Mi"
              limits:
                  memory: "2048Mi"
          startupProbe:
              httpGet:
                  path: "/"
                  port: 3000
              periodSeconds: 5
              failureThreshold: 60
          readinessProbe:
              httpGet:
                  path: "/"
                  port: 3000
              periodSeconds: 5
              timeoutSeconds: 10
          livenessProbe:
              httpGet:
                  path: "/"
                  port: 3000
              failureThreshold: 3
              periodSeconds: 15
        {{- if include "flameHub.harborProxy.enabled" . }}
        # Local-dev only (harborProxy.enabled): forward the aliased Harbor hostname to the
        # in-cluster Harbor service. Real deployments reach Harbor at its public URL directly.
        - name: harbor-proxy-sidecar
          image: alpine/socat
          args: ["TCP-LISTEN:443,fork,bind=127.0.0.1", "TCP:{{ include "harbor.internalHost" . }}:443"]
          securityContext:
            capabilities:
              add: ["NET_BIND_SERVICE"]
        {{- end }}