apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
spec:
  selector:
    matchLabels:
      app: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
  serviceName: "{{ .Release.Name }}-{{ .Chart.Name }}-service"
  replicas: {{ include "zipline.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.zipline.replicas) }}
  template:
    metadata:
      labels:
        app: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
    spec:
      securityContext:
        {{- include "zipline.podSecurityContext" .Values.zipline.securityContext | nindent 8 }}
      containers:
        - name: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
          image: "ghcr.io/diced/zipline:{{ .Chart.AppVersion }}"
          securityContext:
            {{- include "zipline.containerSecurityContext" .Values.zipline.securityContext | nindent 12 }}
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                  key: connection-url
            # ingress.domain is not a pure Ingress value: it is also the app's
            # default domain for generated share links, so it stays required
            # even when the Ingress is switched off (an empty value would hand
            # out unusable links silently).
            - name: CORE_DEFAULT_DOMAIN
              value: "{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}"
            - name: CORE_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                  key: server-secret
            - name: UPLOADER_ADMIN_LIMIT
              value: 500mb
            {{- range $value := .Values.zipline.env }}
            {{- if $value.value }}
            - name: {{ $value.name | quote }}
              value: {{ tpl $value.value $ | quote }}
            {{- else if $value.valueFrom }}
            {{- if $value.valueFrom.secretKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
            {{- else if $value.valueFrom.configMapKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                configMapKeyRef:
                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
          resources:
            {{- include "zipline.effectiveResources" .Values.zipline.resources | nindent 12 }}
          ports:
            - name: "zipline-server"
              containerPort: 3000
              protocol: TCP
          livenessProbe:
            {{- include "zipline.livenessProbe" .Values.zipline.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- include "zipline.readinessProbe" .Values.zipline.readinessProbe | nindent 12 }}
          startupProbe:
            {{- include "zipline.startupProbe" .Values.zipline.startupProbe | nindent 12 }}
          volumeMounts:
            - name: zipline-volume
              mountPath: /zipline/uploads
              subPath: uploads/
            - name: zipline-volume
              mountPath: /zipline/public
              subPath: public/
            - name: zipline-volume
              mountPath: /zipline/themes
              subPath: themes/
            # Zipline writes temporary chunks/files below /tmp; with a
            # read-only root filesystem this must be a writable emptyDir.
            - name: tmp
              mountPath: /tmp
      automountServiceAccountToken: false
      volumes:
        - name: tmp
          emptyDir: {}
        - name: zipline-volume
          persistentVolumeClaim:
            claimName: {{ .Release.Name }}-{{ .Chart.Name }}-vc