{{- if .Values.matrix.delegation.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
spec:
  replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.delegation.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
  template:
    metadata:
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- toYaml .Values.matrix.delegation.securityContext.pod | nindent 8 }}
      containers:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
          image: "nginx:1.28.3"
          securityContext:
            {{- toYaml .Values.matrix.delegation.securityContext.container | nindent 12 }}
          ports:
            - containerPort: 8080
              name: http
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
            # The mounted nginx.conf points the pid file and all temp paths to
            # /tmp, so a single writable emptyDir suffices with a read-only
            # root filesystem.
            - name: tmp
              mountPath: /tmp
          resources:
            {{- include "matrix-synapse.resources" .Values.matrix.delegation.resources | nindent 12 }}
          readinessProbe:
            httpGet:
              path: /.well-known/matrix/server
              port: http
              scheme: HTTP
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /.well-known/matrix/server
              port: http
              scheme: HTTP
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
          startupProbe:
            httpGet:
              path: /.well-known/matrix/server
              port: http
              scheme: HTTP
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 30
      volumes:
        - name: tmp
          emptyDir: {}
        - name: nginx-config
          configMap:
            name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-config
            items:
              - key: nginx.conf
                path: nginx.conf
{{- end }}