---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-config-map
data:
  APP_NAME: "${APP_APP_NAME}"
  APP_ENV: "${APP_APP_ENV}"
  APP_KEY: "${APP_APP_KEY}"
  APP_DEBUG: "${APP_APP_DEBUG}"
  APP_URL: "https://www.${APP_DOMAIN}"
  LOG_CHANNEL: "k8s"
  DB_HOST: "mariadb-service.common-services"
  DB_DATABASE: "${APP_DB_DATABASE}"
  DB_USERNAME: "${APP_DB_USERNAME}"
  DB_PASSWORD: "${APP_DB_PASSWORD}"
  MAIL_HOST: "${APP_MAIL_HOST}"
  MAIL_PORT: "${APP_MAIL_PORT}"
  MAIL_USERNAME: "${APP_MAIL_USERNAME}"
  MAIL_PASSWORD: "${APP_MAIL_PASSWORD}"
  MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}"
  MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}"
  MAIL_FROM_NAME: "${APP_APP_NAME}"
  LDC_STATUS_CHECKER_API_KEY: "${APP_LDC_WEB_API_KEY}"
  LDC_STATUS_CHECKER_UUID: "${APP_LDC_STATUS_CHECKER_UUID}"
  LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}"
  GOOGLE_MAPS_KEY: "${APP_GOOGLE_MAPS_KEY}"
  GOOGLE_RECAPTCHA_PRIVATE: "${APP_GOOGLE_RECAPTCHA_PRIVATE}"
  GOOGLE_RECAPTCHA_PUBLIC: "${APP_GOOGLE_RECAPTCHA_PUBLIC}"
  GOOGLE_RECAPTCHA_VERSION: "${APP_GOOGLE_RECAPTCHA_VERSION}"
  SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
  MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}"

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-pvc-storage
spec:
  storageClassName: "csi-cinder-classic"
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: $APP_PVC_SIZE

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${CI_PROJECT_PATH_SLUG}-app
  template:
    metadata:
      labels:
        app: ${CI_PROJECT_PATH_SLUG}-app
    spec:
      containers:
        - name: ${CI_PROJECT_PATH_SLUG}-container
          image: $IMAGE_TAG
          envFrom:
            - configMapRef:
                name: ${CI_PROJECT_PATH_SLUG}-config-map
          volumeMounts:
            - name: storage
              mountPath: /app/srcs/storage
      imagePullSecrets:
        - name: docker-registry-credentials
      securityContext:
        runAsUser: 33
        runAsGroup: 33
        fsGroup: 33
        fsGroupChangePolicy: "OnRootMismatch"
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage


---
apiVersion: v1
kind: Service
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-service
spec:
  selector:
    app: ${CI_PROJECT_PATH_SLUG}-app
  ports:
    - port: 80
      targetPort: 4433

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-ingress-route
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`${APP_DOMAIN}`, `www.${APP_DOMAIN}`)
      kind: Rule
      services:
        - name: ${CI_PROJECT_PATH_SLUG}-service
          port: 80
      middlewares:
        - name: redirect-no-www-to-www
          namespace: common-services
  tls:
    secretName: $APP_DOMAIN

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: $APP_DOMAIN
spec:
  dnsNames:
    - $APP_DOMAIN
    - www.${APP_DOMAIN}
  secretName: $APP_DOMAIN
  issuerRef:
    name: $APP_CERT_ISSUER
    kind: ClusterIssuer

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-cronjob
spec:
  schedule: "* * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          affinity:
            podAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
              - labelSelector:
                  matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - ${CI_PROJECT_PATH_SLUG}-app
                topologyKey: "kubernetes.io/hostname"
                namespaces: [$KUBE_NAMESPACE]
          containers:
          - name: ${CI_PROJECT_PATH_SLUG}-scheduled
            image: $IMAGE_TAG
            imagePullPolicy: Always
            command:
            - "php"
            args:
            - "artisan"
            - "schedule:run"
            envFrom:
            - configMapRef:
                name: ${CI_PROJECT_PATH_SLUG}-config-map
            volumeMounts:
            - name: storage
              mountPath: /app/srcs/storage
          imagePullSecrets:
          - name: docker-registry-credentials
          volumes:
          - name: storage
            persistentVolumeClaim:
              claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
          securityContext:
            runAsUser: 33
            runAsGroup: 33
            fsGroup: 33
            fsGroupChangePolicy: "OnRootMismatch"
          restartPolicy: OnFailure