{{- $fullname := include "aptly.fullname" . -}}
{{- $hasGpgSecret := or .Values.aptly.gpg.signingKey.existingSecret (and (not .Values.aptly.gpg.signingKey.existingSecret) .Values.aptly.gpg.signingKey.privateKey) -}}
{{- $gpgSecretName := .Values.aptly.gpg.signingKey.existingSecret | default (printf "%s-gpg" $fullname) -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ $fullname }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
  {{- with .Values.workload.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  serviceName: {{ $fullname }}
  # LevelDB (aptly's database) takes an exclusive OS-level file lock — two
  # writers would corrupt it. A StatefulSet with replicas=1 always terminates
  # the old pod before creating its replacement, so RollingUpdate is safe
  # here in a way it would not be for a Deployment on a ReadWriteOnce PVC
  # (which would deadlock on a Multi-Attach error instead).
  replicas: 1
  podManagementPolicy: {{ .Values.workload.podManagementPolicy }}
  revisionHistoryLimit: {{ .Values.workload.revisionHistoryLimit }}
  updateStrategy:
    type: {{ .Values.workload.updateStrategy.type }}
  selector:
    matchLabels:
      {{- include "aptly.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "aptly.selectorLabels" . | nindent 8 }}
        {{- with .Values.workload.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      annotations:
        checksum/config: {{ include "aptly.config" . | sha256sum }}
        checksum/nginx: {{ include "aptly.nginxConf" . | sha256sum }}
        {{- with .Values.workload.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- include "aptly.imagePullSecrets" . | nindent 6 }}
      {{- with include "aptly.serviceAccountName" . }}
      serviceAccountName: {{ . }}
      {{- end }}
      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
      terminationGracePeriodSeconds: {{ .Values.workload.terminationGracePeriodSeconds }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.priorityClassName }}
      priorityClassName: {{ . }}
      {{- end }}
      initContainers:
        - name: config-init
          image: {{ include "aptly.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["/usr/local/bin/aptly-init"]
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          env:
            - name: APTLY_ROOT_DIR
              value: /var/lib/aptly
            - name: APTLY_CONFIG_SRC
              value: /etc/aptly-src/aptly.yaml
            - name: APTLY_CONFIG_DST
              value: /run/aptly/aptly.yaml
            - name: APTLY_GPG_ENABLED
              value: {{ .Values.aptly.gpg.enabled | quote }}
            {{- if not .Values.security.auth.existingSecret }}
            - name: APTLY_USERS_FILE
              value: /etc/aptly-secrets/users
            {{- else }}
            - name: APTLY_HTPASSWD_SRC
              value: /etc/aptly-secrets-existing/htpasswd
            {{- end }}
            {{- if .Values.security.auth.internalUser.enabled }}
            - name: APTLY_INTERNAL_USER
              value: {{ .Values.security.auth.internalUser.username | quote }}
            - name: APTLY_INTERNAL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $fullname }}-credentials
                  key: internal-password
            {{- end }}
            {{- if $hasGpgSecret }}
            - name: APTLY_GPG_PRIVATE_KEY_FILE
              value: /etc/aptly-gpg/privateKey
            - name: APTLY_GPG_SECRET_KEYRING_FILE
              value: /etc/aptly-gpg/secretKeyring
            - name: APTLY_GPG_PASSPHRASE_FILE
              value: /etc/aptly-gpg/passphrase
            {{- end }}
            {{- if .Values.aptly.gpgKeys }}
            - name: APTLY_GPG_KEYS_DIR
              value: /etc/aptly-gpg-keys
            {{- end }}
          volumeMounts:
            - name: config-src
              mountPath: /etc/aptly-src
              readOnly: true
            - name: run
              mountPath: /run/aptly
            - name: data
              mountPath: /var/lib/aptly
            {{- if not .Values.security.auth.existingSecret }}
            - name: credentials
              mountPath: /etc/aptly-secrets
              readOnly: true
            {{- else }}
            - name: credentials-existing
              mountPath: /etc/aptly-secrets-existing
              readOnly: true
            {{- end }}
            {{- if $hasGpgSecret }}
            - name: gpg-secret
              mountPath: /etc/aptly-gpg
              readOnly: true
            {{- end }}
            {{- if .Values.aptly.gpgKeys }}
            - name: gpg-keys
              mountPath: /etc/aptly-gpg-keys
              readOnly: true
            {{- end }}
        {{- with .Values.extraInitContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      containers:
        - name: aptly
          image: {{ include "aptly.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          env:
            - name: APTLY_API_LISTEN
              value: {{ include "aptly.apiListen" . }}
            - name: APTLY_CONFIG
              value: /run/aptly/aptly.yaml
            - name: GNUPGHOME
              value: /run/aptly/gnupg
            {{- with .Values.extraEnv }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          {{- if or .Values.aptly.existingSecretEnv .Values.extraEnvFrom }}
          envFrom:
            {{- range .Values.aptly.existingSecretEnv }}
            - secretRef:
                name: {{ . }}
            {{- end }}
            {{- with .Values.extraEnvFrom }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          {{- end }}
          ports:
            - name: aptly
              containerPort: {{ .Values.ports.aptly }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/aptly
            - name: run
              mountPath: /run/aptly
            - name: tmp
              mountPath: /tmp
            {{- with .Values.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
          # exec, not httpGet: aptly listens on 127.0.0.1 only (see
          # aptly.apiListen) when proxy.enabled=true, but kubelet's httpGet
          # probes connect to the POD IP, not localhost — that dials a
          # loopback-only listener from outside and gets "connection
          # refused". exec runs curl inside this container's own netns,
          # where 127.0.0.1 is correct in either proxy mode.
          startupProbe:
            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
            periodSeconds: {{ .Values.probes.startup.periodSeconds }}
            failureThreshold: {{ .Values.probes.startup.failureThreshold }}
          readinessProbe:
            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
          livenessProbe:
            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/healthy"] }
            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
        - name: nginx
          image: {{ include "aptly.nginxImage" . }}
          imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
          securityContext:
            {{- toYaml .Values.nginx.securityContext | nindent 12 }}
          ports:
            - name: http
              containerPort: {{ .Values.ports.nginx }}
            {{- if .Values.metrics.service.enabled }}
            - name: metrics
              containerPort: {{ .Values.ports.metrics }}
            {{- end }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/aptly/public
              subPath: public
              readOnly: true
            - name: run
              mountPath: /run/aptly
              readOnly: true
            - name: nginx-config
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
              readOnly: true
            - name: tmp
              mountPath: /tmp
            - name: nginx-cache
              mountPath: /var/cache/nginx
          readinessProbe:
            httpGet: { path: /healthz, port: http }
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /healthz, port: http }
            periodSeconds: 30
          resources:
            {{- toYaml .Values.nginx.resources | nindent 12 }}
        {{- with .Values.extraContainers }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      volumes:
        - name: config-src
          configMap:
            name: {{ $fullname }}-config
        - name: nginx-config
          configMap:
            name: {{ $fullname }}-nginx
        - name: run
          emptyDir:
            medium: Memory
            sizeLimit: 16Mi
        - name: tmp
          emptyDir: {}
        - name: nginx-cache
          emptyDir: {}
        {{- if not .Values.security.auth.existingSecret }}
        - name: credentials
          secret:
            secretName: {{ $fullname }}-credentials
            optional: true
        {{- else }}
        - name: credentials-existing
          secret:
            secretName: {{ .Values.security.auth.existingSecret }}
        {{- end }}
        {{- if $hasGpgSecret }}
        - name: gpg-secret
          secret:
            secretName: {{ $gpgSecretName }}
            optional: true
        {{- end }}
        {{- if .Values.aptly.gpgKeys }}
        - name: gpg-keys
          configMap:
            name: {{ $fullname }}-gpg-keys
        {{- end }}
        {{- if not .Values.persistence.enabled }}
        - name: data
          emptyDir: {}
        {{- else if .Values.persistence.existingClaim }}
        - name: data
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim }}
        {{- end }}
        {{- with .Values.extraVolumes }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
  {{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
  volumeClaimTemplates:
    - metadata:
        name: data
        {{- with .Values.persistence.annotations }}
        annotations:
          {{- toYaml . | nindent 10 }}
        {{- end }}
      spec:
        accessModes: [{{ .Values.persistence.accessMode }}]
        {{- $sc := .Values.persistence.storageClass | default .Values.global.defaultStorageClass }}
        {{- if $sc }}
        storageClassName: {{ $sc }}
        {{- end }}
        resources:
          requests:
            storage: {{ .Values.persistence.size }}
  {{- end }}