#!/usr/bin/env bash
set -euo pipefail

# Deploy Postgres for la-huasca in its own namespace

NAMESPACE="${NAMESPACE:-lahuasca}"
SECRET_NAME="la-huasca-db-secrets"
PVC_NAME="postgres-data"

# Generate a secure random password if secret doesn't exist yet
if ! kubectl get secret "$SECRET_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
  echo "==> Generating database password ..."
  PASSWORD=$(openssl rand -base64 32 | tr -d '\n')
  DATABASE_URL="postgres://lahuasca:$PASSWORD@postgres.$NAMESPACE.svc.cluster.local:5432/lahuasca"

  kubectl create secret generic "$SECRET_NAME" \
    --namespace "$NAMESPACE" \
    --from-literal=POSTGRES_USER=lahuasca \
    --from-literal=POSTGRES_PASSWORD="$PASSWORD" \
    --from-literal=POSTGRES_DB=lahuasca \
    --from-literal=DATABASE_URL="$DATABASE_URL"
  echo "==> Created $SECRET_NAME"
else
  echo "==> $SECRET_NAME already exists, leaving it"
fi

# Ensure PVC exists
if ! kubectl get pvc "$PVC_NAME" -n "$NAMESPACE" >/dev/null 2>&1; then
  echo "==> Creating Postgres PVC ..."
  cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: $PVC_NAME
  namespace: $NAMESPACE
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
EOF
fi

# Deploy Postgres
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  namespace: $NAMESPACE
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:15-alpine
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: $SECRET_NAME
                  key: POSTGRES_USER
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: $SECRET_NAME
                  key: POSTGRES_PASSWORD
            - name: POSTGRES_DB
              valueFrom:
                secretKeyRef:
                  name: $SECRET_NAME
                  key: POSTGRES_DB
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: $PVC_NAME
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: $NAMESPACE
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432
EOF

echo "==> Waiting for postgres to be ready ..."
kubectl rollout status deployment/postgres -n "$NAMESPACE" --timeout=120s

echo ""
echo "Postgres ready in namespace $NAMESPACE"
echo "To reveal the password:"
echo "  kubectl get secret $SECRET_NAME -n $NAMESPACE -o jsonpath='{.data.DATABASE_URL}' | base64 -d"