{{- if .Values.matrix.delegation.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
spec:
  replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.delegation.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
  template:
    metadata:
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
      annotations:
        # Hash of the rendered delegation ConfigMap: a changed nginx.conf
        # changes the pod template and thus rolls the pods. Without it the
        # running nginx keeps serving the old .well-known documents - the
        # config is mounted with subPath (never refreshed by the kubelet) and
        # nginx reads it only at start.
        checksum/config: {{ include (print $.Template.BasePath "/matrix-delegation-nginx.configmap.yaml") . | sha256sum }}
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- include "matrix-synapse.delegation.podSecurityContext" .Values.matrix.delegation.securityContext | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
          image: "{{ .Values.matrix.delegation.image.repository }}:{{ .Values.matrix.delegation.image.tag }}"
          securityContext:
            {{- include "matrix-synapse.delegation.containerSecurityContext" .Values.matrix.delegation.securityContext | nindent 12 }}
          ports:
            - containerPort: 8080
              name: http
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            # The mounted nginx.conf points the pid file and all temp paths to
            # /tmp, so a single writable emptyDir suffices with a read-only
            # root filesystem.
            - name: tmp
              mountPath: /tmp
          resources:
            {{- include "matrix-synapse.delegation.effectiveResources" .Values.matrix.delegation.resources | nindent 12 }}
          readinessProbe:
            {{- include "matrix-synapse.delegation.readinessProbe" .Values.matrix.delegation.readinessProbe | nindent 12 }}
          livenessProbe:
            {{- include "matrix-synapse.delegation.livenessProbe" .Values.matrix.delegation.livenessProbe | nindent 12 }}
          startupProbe:
            {{- include "matrix-synapse.delegation.startupProbe" .Values.matrix.delegation.startupProbe | nindent 12 }}
      volumes:
        - name: tmp
          emptyDir: {}
        - name: nginx-config
          configMap:
            name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-configmap
            items:
              - key: nginx.conf
                path: nginx.conf
{{- end }}