apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "go-places.fullname" . }}
  labels:
    {{- include "go-places.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  {{- if .Values.persistence.enabled }}
  # Recreate, not RollingUpdate: the volume is ReadWriteOnce and SQLite allows a
  # single writer, so the old pod must be gone before the new one mounts the
  # claim and opens the database.
  strategy:
    type: Recreate
  {{- end }}
  selector:
    matchLabels:
      {{- include "go-places.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "go-places.selectorLabels" . | nindent 8 }}
    spec:
      securityContext:
        # The image runs as uid 10001. fsGroup makes the mounted volume group
        # writable by that user, which is what allows the non-root process to
        # create the database file and the media directory.
        {{- if .Values.persistence.enabled }}
        fsGroup: {{ .Values.securityContext.fsGroup }}
        {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          env:
            # These names must match the variables read by
            # internal/config.Load(). Unrecognised names are ignored, so a typo
            # here would silently leave the service on its defaults.
            - name: ADDR
              value: ":8080"
            - name: DATABASE_URL
              value: {{ .Values.apiConfig.databaseURL | quote }}
            - name: MEDIA_DIR
              value: {{ .Values.apiConfig.mediaDir | quote }}
            - name: PUBLIC_BASE_URL
              value: {{ .Values.apiConfig.publicBaseURL | quote }}
            # "jwt" verifies the HS256 tokens go-loose issues. The secret is
            # referenced rather than inlined so it can come from a Secret.
            - name: AUTH_MODE
              value: {{ .Values.apiConfig.authMode | quote }}
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.apiConfig.jwtSecretName | quote }}
                  key: {{ .Values.apiConfig.jwtSecretKey | quote }}
                  optional: true
            - name: JWT_AUDIENCE
              value: {{ .Values.apiConfig.jwtAudience | quote }}
            - name: ANALYZER_MODE
              value: {{ .Values.apiConfig.analyzerMode | quote }}
            - name: ANALYZER_URL
              value: {{ .Values.apiConfig.analyzerUrl | quote }}
            - name: LOG_FORMAT
              value: {{ .Values.apiConfig.logFormat | quote }}
            {{- if .Values.apiConfig.amqpUrl }}
            # Event publishing is off unless a broker URL is given; without it
            # the service logs events instead.
            - name: AMQP_URL
              value: {{ .Values.apiConfig.amqpUrl | quote }}
            {{- end }}
            - name: EVENTS_EXCHANGE
              value: {{ .Values.apiConfig.eventsExchange | quote }}
          {{- with .Values.probes.livenessProbe }}
          livenessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.probes.readinessProbe }}
          readinessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: {{ .Values.persistence.mountPath | quote }}
      volumes:
        - name: data
          {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "go-places.fullname" .)) }}
          {{- else }}
          # Without persistence the service still runs, but the database and every
          # uploaded picture are lost whenever the pod is replaced.
          emptyDir: {}
          {{- end }}