# Fixtures for the stalwart install-test: a throwaway Postgres, the one Secret
# the 1Password operator would otherwise materialize, and a stub CRD for
# cert-manager's Certificate (release name: ci; the OnePasswordItem stub CRD
# comes from ci/common/).
#
# NO VALKEY HERE, DELIBERATELY. The in-memory store is an object in Stalwart's
# DATABASE, not a chart value, so a Valkey in this namespace would be reachable
# and unused - it would make the test look like it covered the clustering path
# while covering nothing of it. The test runs a single node (nodes.full
# replicas 1, nodes.mx replicas 0), which is the configuration that needs no
# in-memory store at all. The subchart path is covered by a local render only,
# named as a known gap in the PR that introduced this chart.
#
# A stub CRD for Certificate rather than certificate.enabled: false, because
# switching the Certificate off would also drop the volume and volumeMount that
# carry it - and the mount is on the risky side of readOnlyRootFilesystem. With
# the stub the object applies, the Secret it names never appears, and the
# optional: true on the volume is exercised for real: the pods must start
# without it. That is the behaviour an operator meets on every first install,
# before cert-manager has answered the challenge.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: certificates.cert-manager.io
spec:
  group: cert-manager.io
  names:
    kind: Certificate
    listKind: CertificateList
    plural: certificates
    singular: certificate
  scope: Namespaced
  versions:
    - name: v1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          x-kubernetes-preserve-unknown-fields: true
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-stalwart-datastore-secret
stringData:
  # The ONLY field this chart reads from the data store item. config.json
  # references it by variable name through
  #   "authSecret": {"@type":"EnvironmentVariable","variableName":"STALWART_DB_PASSWORD"}
  # so this value has to match the throwaway Postgres below. A real password
  # rather than an empty string on purpose: upstream's resolver treats an empty
  # environment variable as "not found" and fails the store open, so an empty
  # value here would fail the run for the right reason in the wrong place.
  password: ci-stalwart-throwaway-password
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: public.ecr.aws/docker/library/postgres:16-alpine
          env:
            - name: POSTGRES_USER
              value: stalwart
            - name: POSTGRES_PASSWORD
              value: ci-stalwart-throwaway-password
            - name: POSTGRES_DB
              value: stalwart
          ports:
            - containerPort: 5432
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "stalwart"]
            periodSeconds: 5
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432