{{- if not .Values.config.serverName -}}
{{- fail "A valid .Values.config.serverName is required" -}}
{{- end -}}
{{- $needsVolumePermissions := and .Values.volumePermissions.enabled (or .Values.persistence.enabled .Values.persistence.existingClaim) }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "matrix-synapse.fullname" . }}
  labels:
    {{- include "matrix-synapse.labels" . | nindent 4 }}
    app.kubernetes.io/component: synapse
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "matrix-synapse.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: synapse
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") . | sha256sum }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
        {{- with .Values.synapse.annotations }}
        {{ . | toYaml | nindent 8 }}
        {{- end }}
      labels:
        {{- include "matrix-synapse.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: synapse
        {{- with .Values.synapse.labels }}
        {{ . | toYaml | nindent 8 }}
        {{- end }}
    spec:
      {{- include "matrix-synapse.imagePullSecrets" . | nindent 6 }}
      securityContext:
        {{- toYaml .Values.synapse.podSecurityContext | nindent 8 }}
      containers:
        - name: synapse
          command:
            - sh
            - -c
            - |
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              /matrix-synapse $@
          args:
            - synapse.app.homeserver
          env:
          {{- if .Values.postgresql.enabled }}
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "matrix-synapse.postgresql.fullname" . }}
                  key: postgresql-password
          {{- end }}
          {{- if and .Values.redis.enabled (default .Values.redis.usePassword true) }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "matrix-synapse.redis.fullname" . }}
                  key: redis-password
          {{- end }}
          {{- with .Values.extraEnv }}
            {{ . | toYaml }}
          {{- end }}
          image: "{{ .Values.image.repository }}:{{ include "matrix-synapse.imageTag" . }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          ports:
            - name: http
              containerPort: 8008
              protocol: TCP
            - name: replication
              containerPort: 9093
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: http
          readinessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: http
          volumeMounts:
            - name: config
              mountPath: /synapse/config
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
            - name: media
              mountPath: /synapse/data
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
        - name: config
          configMap:
            name: {{ include "matrix-synapse.fullname" . }}
        - name: secrets
          secret:
            secretName: {{ include "matrix-synapse.fullname" . }}
        - name: signingkey
          secret:
            secretName: {{ .Values.signingkey.existingSecret | default (include "matrix-synapse.workername" (dict "global" . "worker" "signingkey")) | quote }}
            items:
              - key: {{ .Values.signingkey.existingSecretKey | default "signing.key" | quote }}
                path: signing.key
        - name: tmpconf
          emptyDir: {}
        - name: media

        {{- $mediaworker := false }}
        {{- range $worker, $config := .Values.workers }}
          {{- if eq $worker "media-repository" }}
            {{- $mediaworker = true }}
          {{- end }}
        {{- end }}
        {{- if and .Values.persistence.enabled (not $mediaworker) }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "matrix-synapse.fullname" .) }}
        {{- else }}
          emptyDir: {}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}