{{- if not .Values.config.serverName -}}
{{- fail "A valid .Values.config.serverName is required" -}}
{{- end -}}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "matrix-synapse.fullname" . }}
  labels:
    {{- include "matrix-synapse.labels" . | nindent 4 }}
    component: synapse
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "matrix-synapse.selectorLabels" . | nindent 6 }}
      component: synapse
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") . | sha256sum }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
      labels:
        {{- include "matrix-synapse.selectorLabels" . | nindent 8 }}
        component: synapse
    spec:
    {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          command:
            - sh
            - -c
            - |
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              /matrix-synapse $@
          args:
            - synapse.app.homeserver
          env:
          {{- if .Values.postgresql.enabled }}
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "matrix-synapse.postgresql.fullname" . }}
                  key: postgresql-password
          {{- end }}
          {{- if and .Values.redis.enabled (default .Values.redis.usePassword true) }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "matrix-synapse.redis.fullname" . }}
                  key: redis-password
          {{- end }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ include "matrix-synapse.imageTag" . }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: 8008
              protocol: TCP
            - name: replication
              containerPort: 9093
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: http
          readinessProbe:
            httpGet:
              path: /_matrix/client/versions
              port: http
          volumeMounts:
            - name: config
              mountPath: /synapse/config
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
        - name: config
          configMap:
            name: {{ include "matrix-synapse.fullname" . }}
        - name: secrets
          secret:
            secretName: {{ include "matrix-synapse.fullname" . }}
        - name: signingkey
          secret:
            secretName: {{ default .Values.signingkey.existingSecret (include "matrix-synapse.workername" (dict "global" . "worker" "signingkey")) | quote }}
            items:
              - key: {{ default .Values.signingkey.existingSecretKey "signing.key" | quote }}
                path: signing.key
        - name: tmpconf
          emptyDir: {}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}

{{- $default := .Values.workers.default }}
{{- range $worker, $config := .Values.workers }}
{{- if $config.enabled }}
{{- $name := $worker | replace "_" "-" }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "matrix-synapse.workername" (dict "global" $ "worker" $name) }}
  labels:
    {{- include "matrix-synapse.labels" $ | nindent 4 }}
    component: worker
    worker: {{ $name }}
spec:
  replicas: {{ $config.replicaCount | default $default.replicaCount }}
  selector:
    matchLabels:
      {{- include "matrix-synapse.selectorLabels" $ | nindent 6 }}
      component: worker
      worker: {{ $name }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") $ | sha256sum }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") $ | sha256sum }}
      labels:
        {{- include "matrix-synapse.selectorLabels" $ | nindent 8 }}
        component: worker
        worker: {{ $name }}
    spec:
    {{- with $.Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      securityContext:
        {{- $config.podSecurityContext | default $default.podSecurityContext | toYaml | nindent 8 }}
      containers:
        - name: {{ $name }}
          command:
            - sh
            - -c
            - |
              cat /synapse/secrets/*.yaml | \
                sed -e "s/@@POSTGRES_PASSWORD@@/${POSTGRES_PASSWORD:-}/" \
                    -e "s/@@REDIS_PASSWORD@@/${REDIS_PASSWORD:-}/" \
                       > /synapse/config/conf.d/secrets.yaml

              /matrix-synapse synapse.app.{{ $worker }} -c /synapse/config/{{ $name }}.worker
          securityContext:
            {{- $config.securityContext | default $default.securityContext | toYaml | nindent 12 }}
          image: "{{ $.Values.image.repository }}:{{ $.Chart.AppVersion }}"
          imagePullPolicy: {{ $.Values.image.pullPolicy }}
          ports:
          {{- if $config.metrics | default $default.metrics }}
            - name: metrics
              containerPort: 9090
              protocol: TCP
          {{- end }}
          {{- if $config.listeners }}
            - name: listener
              containerPort: 8083
              protocol: TCP
          livenessProbe:
            tcpSocket:
              port: listener
          readinessProbe:
            tcpSocket:
              port: listener
          {{- end }}
          resources:
            {{- $config.resources | default $default.resources | toYaml | nindent 12 }}
          volumeMounts:
            - name: config
              mountPath: /synapse/config
            - name: tmpconf
              mountPath: /synapse/config/conf.d
            - name: secrets
              mountPath: /synapse/secrets
            - name: signingkey
              mountPath: /synapse/keys
          {{- if eq $name "media-repository" }}
            - name: media
              mountPath: /synapse/data
          {{- end }}
          {{- with $config.volumeMounts | default $default.volumeMounts }}
            {{ . | toYaml | nindent 12 }}
          {{- end }}
      {{- with $config.nodeSelector | default $default.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
    {{- with $config.affinity | default $default.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
    {{- with $config.tolerations | default $default.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      volumes:
        - name: config
          configMap:
            name: {{ include "matrix-synapse.fullname" $ }}
        - name: secrets
          secret:
            secretName: {{ include "matrix-synapse.fullname" $ }}
        - name: signingkey
          secret:
            secretName: {{ default $.Values.signingkey.existingSecret (include "matrix-synapse.workername" (dict "global" $ "worker" "signingkey")) | quote }}
            items:
              - key: {{ default $.Values.signingkey.existingSecretKey "signing.key" | quote }}
                path: signing.key
        - name: tmpconf
          emptyDir: {}
      {{- if eq $name "media-repository" }}
        - name: media
          persistentVolumeClaim:
            claimName: 
      {{- end }}
      {{- with $config.volumes }}
        {{ . | toYaml | nindent 8 }}
      {{- end }}
{{- end }}
{{- end }}