apiVersion: v1
kind: Service
metadata:
  name: expense-tracker-postgres
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker-postgres
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  selector:
    app.kubernetes.io/name: expense-tracker-postgres
  ports:
    - name: postgres
      port: 5432
      targetPort: postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: expense-tracker-postgres
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker-postgres
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  serviceName: expense-tracker-postgres
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: expense-tracker-postgres
  template:
    metadata:
      labels:
        app.kubernetes.io/name: expense-tracker-postgres
    spec:
      securityContext:
        # uid/gid of the `postgres` user in the alpine image
        runAsUser: 70
        runAsGroup: 70
        fsGroup: 70
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: postgres
          image: {{ .Values.postgres.image | quote }}
          ports:
            - name: postgres
              containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: {{ .Values.postgres.database | quote }}
            - name: POSTGRES_USER
              value: {{ .Values.postgres.user | quote }}
            # Only used when the data directory is first initialised; changing it later in
            # OpenBao does NOT change the database user's password (see README).
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-db
                  key: POSTGRES_PASSWORD
            # A sub-directory, because the volume root may contain lost+found.
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          readinessProbe:
            exec:
              command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            exec:
              command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 3
            failureThreshold: 6
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            {{- toYaml .Values.postgres.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
            # Unix socket dir + scratch space (the image writes there as the postgres user)
            - name: run
              mountPath: /var/run/postgresql
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: run
          emptyDir: {}
        - name: tmp
          emptyDir: {}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        {{- if .Values.postgres.persistence.storageClassName }}
        storageClassName: {{ .Values.postgres.persistence.storageClassName }}
        {{- end }}
        resources:
          requests:
            storage: {{ .Values.postgres.persistence.size }}