apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
spec:
  serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
  replicas: {{ include "matrix-synapse.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.matrix.replicas) }}
  selector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  template:
    metadata:
      name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
      labels:
        app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
    spec:
      automountServiceAccountToken: false
      securityContext:
        {{- include "matrix-synapse.podSecurityContext" .Values.matrix.securityContext | nindent 8 }}
      containers:
        - name: "{{ .Release.Name }}-{{ .Chart.Name }}-container"
          image: "ghcr.io/element-hq/synapse:{{ .Chart.AppVersion }}"
          securityContext:
            {{- include "matrix-synapse.containerSecurityContext" .Values.matrix.securityContext | nindent 12 }}
          env:
            - name: SYNAPSE_SERVER_NAME
              value: "{{ required "You must provide a Server-Name" .Values.matrix.serverName }}"
            - name: SYNAPSE_REPORT_STATS
              value: "no"
            - name: TZ
              value: "{{ .Values.matrix.timezone }}"
            {{- range $value := .Values.matrix.env }}
            {{- if $value.value }}
            - name: {{ $value.name }}
              value: {{ tpl $value.value $ }}
            {{- else if $value.valueFrom }}
            {{- if $value.valueFrom.secretKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                secretKeyRef:
                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
            {{- else if $value.valueFrom.configMapKeyRef }}
            - name: {{ $value.name }}
              valueFrom:
                configMapKeyRef:
                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
            {{- end }}
            {{- end }}
            {{- end }}
          ports:
            - name: http
              containerPort: 8008
              protocol: TCP
          readinessProbe:
            {{- include "matrix-synapse.readinessProbe" .Values.matrix.readinessProbe | nindent 12 }}
          livenessProbe:
            {{- include "matrix-synapse.livenessProbe" .Values.matrix.livenessProbe | nindent 12 }}
          startupProbe:
            {{- include "matrix-synapse.startupProbe" .Values.matrix.startupProbe | nindent 12 }}
          resources:
            {{- include "matrix-synapse.effectiveResources" .Values.matrix.resources | nindent 12 }}
          volumeMounts:
            - name: matrix-synapse-volume
              mountPath: /data
              subPath: matrix-synapse-data/
            - name: matrix-synapse-volume
              mountPath: /media_store
              subPath: matrix-media-store/
            - name: matrix-synapse-config-secret
              mountPath: /data/homeserver.yaml
              subPath: homeserver.yaml
            # Scratch space so the read-only root filesystem never blocks
            # temp-file writes (e.g. URL-preview downloads).
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
        - name: matrix-synapse-volume
          persistentVolumeClaim:
            claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc
        - name: matrix-synapse-config-secret
          secret:
            secretName: {{ .Release.Name }}-{{ .Chart.Name }}-config-secret
            items:
              - key: homeserver.yaml
                path: homeserver.yaml