---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: &app tandoor
  namespace: default
spec:
  interval: 30m
  chart:
    spec:
      chart: app-template
      version: 1.5.1
      sourceRef:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
  maxHistory: 2
  install:
    createNamespace: true
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      retries: 3
  uninstall:
    keepHistory: false
  values:
    controller:
      annotations:
        reloader.stakater.com/auto: "true"
    image:
      repository: vabene1111/recipes
      tag: 1.5.6
    envFrom: &envFrom
      - secretRef:
          name: tandoor-secret
    env:
      DEBUG: "0"
      ALLOWED_HOSTS: "*"
      DB_ENGINE: django.db.backends.postgresql_psycopg2
      GUNICORN_MEDIA: "0"
      TIMEZONE: ${TIMEZONE}
      TANDOOR_PORT: 8888
      FRACTION_PREF_DEFAULT: "0"
      COMMENT_PREF_DEFAULT: "1"
      SHOPPING_MIN_AUTOSYNC_INTERVAL: "5"
    command:
      - /opt/recipes/venv/bin/gunicorn
      - -b
      - :8888
      - --access-logfile
      - "-"
      - --error-logfile
      - "-"
      - --log-level
      - INFO
      - recipes.wsgi
    service:
      main:
        ports:
          http:
            port: &port 8888
          nginx:
            port: &port2 8080
    ingress:
      main:
        enabled: true
        ingressClassName: "nginx"
        annotations:
          hajimari.io/icon: mdi:chef-hat
        hosts:
          - host: &host "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
            paths: &paths
              - path: /
              - path: /media
                service:
                  port: *port2
              - path: /static
                service:
                  port: *port2
          - host: &host2 "recipes.${SECRET_CLUSTER_DOMAIN}"
            paths: *paths
        tls:
          - hosts:
              - *host
              - *host2
    persistence:
      files:
        enabled: true
        existingClaim: tandoor-files
        mountPath: /opt/recipes/mediafiles
      nginx-config:
        enabled: "true"
        mountPath: /etc/nginx/nginx.conf
        subPath: nginx-config
        type: "custom"
        volumeSpec:
          configMap:
            name: tandoor-configmap
      django-js-reverse:
        enabled: true
        type: emptyDir
        mountPath: /opt/recipes/cookbook/static/django_js_reverse
      static:
        enabled: true
        mountPath: /opt/recipes/staticfiles
        type: emptyDir
      cache:
        enabled: true
        mountPath: /mnt/cache
        type: emptyDir
    podSecurityContext:
      runAsUser: 568
      runAsGroup: 568
      fsGroup: 568
      fsGroupChangePolicy: "OnRootMismatch"
    resources:
      requests:
        cpu: 100m
        memory: 256Mi
      limits:
        memory: 512Mi
    initContainers:
      01-init-db:
        image: ghcr.io/auricom/postgres-init:15.4
        imagePullPolicy: IfNotPresent
        envFrom: *envFrom
      02-init-migrate:
        image: vabene1111/recipes:1.5.6
        env:
          - name: DB_ENGINE
            value: django.db.backends.postgresql_psycopg2
          - name: POSTGRES_HOST
            value: ${POSTGRES_HOST}
          - name: POSTGRES_PORT
            value: ${POSTGRES_PORT}
          - name: POSTGRES_DB
            value: tandoor
        envFrom:
          - secretRef:
              name: tandoor-secret
        command:
        - sh
        - -c
        - |
          set -e
          source /opt/recipes/venv/bin/activate
          echo "Updating database"
          python3 /opt/recipes/manage.py migrate
          python3 /opt/recipes/manage.py collectstatic_js_reverse
          python3 /opt/recipes/manage.py collectstatic --noinput
        volumeMounts:
          - name: django-js-reverse
            mountPath: /opt/recipes/cookbook/static/django_js_reverse
          - name: static
            mountPath: /opt/recipes/staticfiles
    sidecars:
      nginx:
        image: nginxinc/nginx-unprivileged:1.25.2-alpine
        imagePullPolicy: IfNotPresent
        ports:
          - name: nginx
            containerPort: *port2
        volumeMounts:
          - name: nginx-config
            readOnly: true
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx-config
          - name: files
            mountPath: /media
          - name: static
            mountPath: /static
          - name: cache
            mountPath: /var/cache/nginx