apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "graphql.fullname" . }}
  labels:
    {{- include "graphql.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "graphql.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "graphql.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "graphql.serviceAccountName" . }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          env:
          - name: AUTH_PRIVATE_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.jwt.secretName }}"
                key: key
          - name: NODE_ENV
            value: "{{ .Values.env }}"
          - name: NO_COLOR
            value: "1"
          - name: SERVER_FLAVOR
            value: "graphql"
          - name: AFFINE_ENV
            value: "{{ .Release.Namespace }}"
          - name: NEXTAUTH_URL
            value: "{{ .Values.global.ingress.host }}"
          - name: DATABASE_PASSWORD
            valueFrom:
              secretKeyRef:
                name: pg-postgresql
                key: postgres-password
          - name: DATABASE_URL
            value: postgres://{{ .Values.global.database.user }}:$(DATABASE_PASSWORD)@{{ .Values.global.database.url }}:{{ .Values.global.database.port }}/{{ .Values.global.database.name }}
          - name: REDIS_SERVER_ENABLED
            value: "true"
          - name: REDIS_SERVER_HOST
            value: "{{ .Values.global.redis.host }}"
          - name: REDIS_SERVER_PORT
            value: "{{ .Values.global.redis.port }}"
          - name: REDIS_SERVER_USER
            value: "{{ .Values.global.redis.username }}"
          - name: REDIS_SERVER_PASSWORD
            valueFrom:
              secretKeyRef:
                name: redis
                key: redis-password
          - name: REDIS_SERVER_DATABASE
            value: "{{ .Values.global.redis.database }}"
          - name: AFFINE_SERVER_PORT
            value: "{{ .Values.service.port }}"
          - name: AFFINE_SERVER_SUB_PATH
            value: "{{ .Values.app.path }}"
          - name: AFFINE_SERVER_HOST
            value: "{{ .Values.app.host }}"
          - name: ENABLE_R2_OBJECT_STORAGE
            value: "{{ .Values.app.objectStorage.r2.enabled }}"
          - name: OAUTH_EMAIL_SENDER
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.email.secretName }}"
                key: sender
          - name: OAUTH_EMAIL_LOGIN
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.email.secretName }}"
                key: login
          - name: OAUTH_EMAIL_SERVER
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.email.secretName }}"
                key: server
          - name: OAUTH_EMAIL_PORT
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.email.secretName }}"
                key: port
          - name: OAUTH_EMAIL_PASSWORD
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.email.secretName }}"
                key: password
          - name: DOC_MERGE_INTERVAL
            value: "{{ .Values.app.doc.mergeInterval }}"
          {{ if .Values.app.experimental.enableJwstCodec }}
          - name: DOC_MERGE_USE_JWST_CODEC
            value: "true"
          {{ end }}
          {{ if .Values.app.objectStorage.r2.enabled }}
          - name: R2_OBJECT_STORAGE_ACCOUNT_ID
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.objectStorage.r2.secretName }}"
                key: accountId
          - name: R2_OBJECT_STORAGE_ACCESS_KEY_ID
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.objectStorage.r2.secretName }}"
                key: accessKeyId
          - name: R2_OBJECT_STORAGE_SECRET_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.objectStorage.r2.secretName }}"
                key: secretAccessKey
          - name: R2_OBJECT_STORAGE_BUCKET
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.objectStorage.r2.secretName }}"
                key: bucket
          {{ end }}
          {{ if .Values.app.oauth.google.enabled }}
          - name: OAUTH_GOOGLE_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.google.secretName }}"
                key: clientId
          - name: OAUTH_GOOGLE_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.google.secretName }}"
                key: clientSecret
          {{ end }}
          {{ if .Values.app.oauth.github.enabled }}
          - name: OAUTH_GITHUB_CLIENT_ID
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.github.secretName }}"
                key: clientId
          - name: OAUTH_GITHUB_CLIENT_SECRET
            valueFrom:
              secretKeyRef:
                name: "{{ .Values.app.oauth.github.secretName }}"
                key: clientSecret
          {{ end }}
          ports:
            - name: http
              containerPort: {{ .Values.service.port }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }}
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
        {{ if .Values.global.database.gcloud.enabled }}
        - name: cloud-sql-proxy
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.6.0
          args:
            - "--structured-logs"
            - "--auto-iam-authn"
            - "{{ .Values.global.database.gcloud.connectionName }}"
          securityContext:
            runAsNonRoot: true
          resources:
            requests:
              memory: "2Gi"
              cpu: "1"
        {{ end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}