apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
  replicas: {{ include "outline.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.outline.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  template:
    metadata:
      name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- include "outline.podSecurityContext" .Values.outline.securityContext | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
          image: "docker.io/outlinewiki/outline:{{ .Chart.AppVersion }}"
          imagePullPolicy: IfNotPresent
          env:
            - name: PORT
              value: "3000"
            # ingress.domain is not a pure Ingress value: it is also Outline's
            # public URL, used for generated links and the OIDC redirect URI,
            # so it stays required even when the Ingress is switched off (an
            # empty value would render "https://" and break logins silently).
            - name: URL
              value: "https://{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}"
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: outline-secret-key
            - name: UTILS_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: outline-utils-secret
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: connection-url
            - name: PGSSLMODE
              value: disable
            - name: REDIS_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
                  key: connection-url
            - name: FILE_STORAGE
              value: "local"
            - name: FILE_STORAGE_LOCAL_ROOT_DIR
              value: "/outline-data/data"
            - name: OIDC_ISSUER_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: discovery-url
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: client-id
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: client-secret
            - name: OIDC_DISPLAY_NAME
              value: "{{ .Values.outline.oidc.displayName }}"
            - name: FILE_STORAGE_UPLOAD_MAX_SIZE
              value: "{{ .Values.outline.maxUploadSize }}"
            - name: FORCE_HTTPS
              value: "{{ .Values.outline.forceHttps }}"
            {{- range $value := .Values.outline.env }}
            {{- if $value.value }}
            - name: {{ $value.name | quote }}
              value: {{ tpl $value.value $ | quote }}
            {{- else if $value.valueFrom }}
            {{- if $value.valueFrom.secretKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
            {{- else if $value.valueFrom.configMapKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                configMapKeyRef:
                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          ports:
            - containerPort: 3000
              protocol: TCP
              name: http
          livenessProbe:
            {{- include "outline.livenessProbe" .Values.outline.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- include "outline.readinessProbe" .Values.outline.readinessProbe | nindent 12 }}
          startupProbe:
            {{- include "outline.startupProbe" .Values.outline.startupProbe | nindent 12 }}
          resources:
            {{- include "outline.effectiveResources" .Values.outline.resources | nindent 12 }}
          securityContext:
            {{- include "outline.containerSecurityContext" .Values.outline.securityContext | nindent 12 }}
          volumeMounts:
            - mountPath: "/outline-data/data"
              name: outline-data
              subPath: data
            # Writable emptyDir so the root filesystem can stay read-only:
            # Outline writes import/export scratch files to /tmp.
            - mountPath: /tmp
              name: tmp
      restartPolicy: Always
      volumes:
        - name: outline-data
          persistentVolumeClaim:
            claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc
        - name: tmp
          emptyDir: {}