---
apiVersion: v1
kind: Namespace
metadata:
  name: tandoor
---
# kubectl -n tandoor create secret generic recipes --from-literal=postgresql-password=$(openssl rand -base64 33) --from-literal=postgresql-postgres-password=$(openssl rand -base64 33) --from-literal=secret-key=$(openssl rand -hex 32)
#kind: Secret
#apiVersion: v1
#metadata:
#  name: recipes
#  namespace: tandoor
#type: Opaque
#data:
#  postgresql-password: ...
#  postgresql-postgres-password: ...
#  secret-key: ...
---
kind: ConfigMap
apiVersion: v1
metadata:
  labels:
    app: recipes
  name: recipes-nginx-config
  namespace: tandoor
data:
  nginx-config: |-
    events {
      worker_connections 1024;
    }
    http {
      include mime.types;
      server {
        listen 80;
        server_name _;

        client_max_body_size 16M;

        # serve static files
        location /static/ {
          alias /static/;
        }
        # serve media files
        location /media/ {
          alias /media/;
        }
      }
    }
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: recipes
  namespace: tandoor
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: recipes-media
  namespace: tandoor
  labels:
    app: recipes
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 100Gi
  storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: recipes-static
  namespace: tandoor
  labels:
    app: recipes
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 100Gi
  storageClassName: rook-cephfs
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: recipes
    tier: database
  name: recipes-postgresql
  namespace: tandoor
spec:
  replicas: 1
  selector:
    matchLabels:
      app: recipes
  serviceName: recipes-postgresql
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        backup.velero.io/backup-volumes: data
      labels:
        app: recipes
        tier: database
      name: recipes-postgresql
    spec:
      containers:
      - name: recipes-db
        env:
        - name: BITNAMI_DEBUG
          value: "false"
        - name: POSTGRESQL_PORT_NUMBER
          value: "5432"
        - name: POSTGRESQL_VOLUME_DIR
          value: /bitnami/postgresql
        - name: PGDATA
          value: /bitnami/postgresql/data
        - name: POSTGRES_USER
          value: recipes
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: recipes
              key: postgresql-password
        - name: POSTGRESQL_POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: recipes
              key: postgresql-postgres-password
        - name: POSTGRES_DB
          value: recipes
        image: docker.io/bitnami/postgresql:15.5.0-debian-11-r17
        imagePullPolicy: IfNotPresent
        livenessProbe:
          exec:
            command:
            - sh
            - -c
            - exec pg_isready -U "postgres" -d "wiki" -h 127.0.0.1 -p 5432
          failureThreshold: 6
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        ports:
        - containerPort: 5432
          name: postgresql
          protocol: TCP
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - -e
            - |
              pg_isready -U "postgres" -d "wiki" -h 127.0.0.1 -p 5432
              [ -f /opt/bitnami/postgresql/tmp/.initialized ]
          failureThreshold: 6
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          requests:
            cpu: 250m
            memory: 256Mi
        securityContext:
          runAsUser: 1001
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /bitnami/postgresql
          name: data
      dnsPolicy: ClusterFirst
      initContainers:
      - command:
        - sh
        - -c
        - |
          mkdir -p /bitnami/postgresql/data
          chmod 700 /bitnami/postgresql/data
          find /bitnami/postgresql -mindepth 0 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
            xargs chown -R 1001:1001
        image: docker.io/bitnami/minideb:stretch
        imagePullPolicy: Always
        name: init-chmod-data
        resources:
          requests:
            cpu: 250m
            memory: 256Mi
        securityContext:
          runAsUser: 0
        volumeMounts:
        - mountPath: /bitnami/postgresql
          name: data
      restartPolicy: Always
      securityContext:
        fsGroup: 1001
      serviceAccount: recipes
      serviceAccountName: recipes
      terminationGracePeriodSeconds: 30
  volumeClaimTemplates:
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 50Gi
      volumeMode: Filesystem
      storageClassName: rook-ssd-block
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: recipes
    tier: database
  name: recipes-postgresql
  namespace: tandoor
spec:
  ports:
  - name: postgresql
    port: 5432
    protocol: TCP
    targetPort: postgresql
  selector:
    app: recipes
    tier: database
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: recipes
  namespace: tandoor
  labels:
    app: recipes
    environment: production
    tier: frontend
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: recipes
      environment: production
  template:
    metadata:
      annotations:
        backup.velero.io/backup-volumes: media,static
      labels:
        app: recipes
        tier: frontend
        environment: production
    spec:
      restartPolicy: Always
      serviceAccount: recipes
      serviceAccountName: recipes
      initContainers:
      - name: init-chmod-data
        env:
          - name: SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: recipes
                key: secret-key
          - name: DB_ENGINE
            value: django.db.backends.postgresql
          - name: POSTGRES_HOST
            value: recipes-postgresql
          - name: POSTGRES_PORT
            value: "5432"
          - name: POSTGRES_USER
            value: postgres
          - name: POSTGRES_DB
            value: recipes
          - name: POSTGRES_PASSWORD
            valueFrom:
              secretKeyRef:
                name: recipes
                key: postgresql-postgres-password
        image: vabene1111/recipes
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 250m
            memory: 64Mi
        command:
        - sh
        - -c
        - |
          set -e
          source venv/bin/activate
          echo "Updating database"
          python manage.py migrate
          python manage.py collectstatic_js_reverse
          python manage.py collectstatic --noinput
          echo "Setting media file attributes"
          chown -R 65534:65534 /opt/recipes/mediafiles
          find /opt/recipes/mediafiles -type d | xargs -r chmod 755
          find /opt/recipes/mediafiles -type f | xargs -r chmod 644
          echo "Done"
        securityContext:
          runAsUser: 0
        volumeMounts:
        - mountPath: /opt/recipes/mediafiles
          name: media
          # mount as subPath due to lost+found on ext4 pvc
          subPath: files
        - mountPath: /opt/recipes/staticfiles
          name: static
          # mount as subPath due to lost+found on ext4 pvc
          subPath: files
      containers:
      - name: recipes-nginx
        image: nginx:latest
        imagePullPolicy: IfNotPresent
        ports:
          - containerPort: 80
            protocol: TCP
            name: http
          - containerPort: 8080
            protocol: TCP
            name: gunicorn
        resources:
          requests:
            cpu: 250m
            memory: 64Mi
        volumeMounts:
          - mountPath: /media
            name: media
            # mount as subPath due to lost+found on ext4 pvc
            subPath: files
          - mountPath: /static
            name: static
            # mount as subPath due to lost+found on ext4 pvc
            subPath: files
          - name: nginx-config
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx-config
            readOnly: true
      - name: recipes
        image: vabene1111/recipes
        imagePullPolicy: IfNotPresent
        command:
          - /opt/recipes/venv/bin/gunicorn
          - -b
          - :8080
          - --access-logfile
          - "-"
          - --error-logfile
          - "-"
          - --log-level
          - INFO
          - recipes.wsgi
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /
            port: 8080
            scheme: HTTP
          periodSeconds: 30
        resources:
          requests:
            cpu: 250m
            memory: 64Mi
        volumeMounts:
          - mountPath: /opt/recipes/mediafiles
            name: media
            # mount as subPath due to lost+found on ext4 pvc
            subPath: files
          - mountPath: /opt/recipes/staticfiles
            name: static
            # mount as subPath due to lost+found on ext4 pvc
            subPath: files
        env:
          - name: DEBUG
            value: "0"
          - name: ALLOWED_HOSTS
            value: '*'
          - name: SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: recipes
                key: secret-key
          - name: GUNICORN_MEDIA
            value: "0"
          - name: DB_ENGINE
            value: django.db.backends.postgresql
          - name: POSTGRES_HOST
            value: recipes-postgresql
          - name: POSTGRES_PORT
            value: "5432"
          - name: POSTGRES_USER
            value: postgres
          - name: POSTGRES_DB
            value: recipes
          - name: POSTGRES_PASSWORD
            valueFrom:
              secretKeyRef:
                name: recipes
                key: postgresql-postgres-password
        securityContext:
          runAsUser: 65534
      volumes:
        - name: media
          persistentVolumeClaim:
            claimName: recipes-media
        - name: static
          persistentVolumeClaim:
            claimName: recipes-static
        - name: nginx-config
          configMap:
            name: recipes-nginx-config
---
apiVersion: v1
kind: Service
metadata:
  name: recipes
  namespace: tandoor
  labels:
    app: recipes
    tier: frontend
spec:
  selector:
    app: recipes
    tier: frontend
    environment: production
  ports:
  - port: 80
    targetPort: http
    name: http
    protocol: TCP
  - port: 8080
    targetPort: gunicorn
    name: gunicorn
    protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: letsencrypt-prod
  name: recipes
  namespace: tandoor
spec:
  ingressClassName: nginx
  rules:
  - host: recipes.tblflp.net
    http:
      paths:
      - backend:
          service:
            name: recipes
            port:
              number: 8080
        path: /
        pathType: Prefix
      - backend:
          service:
            name: recipes
            port:
              number: 80
        path: /media
        pathType: Prefix
      - backend:
          service:
            name: recipes
            port:
              number: 80
        path: /static
        pathType: Prefix
  tls:
  - hosts:
    - recipes.tblflp.net
    secretName: recipes-local-tls