resource "kubernetes_namespace" "ssh_locker_web" {
  metadata {
    name = "ssh-locker-web"
  }
}

resource "kubernetes_secret" "ssh_locker_web" {
  metadata {
    name      = "ssh-locker-web-config"
    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
  }
  data = {
    "config.json" = local.config_json
  }
  type = "Opaque"
}

resource "kubernetes_service_account" "ssh_locker_web" {
  metadata {
    name      = "ssh-locker-web"
    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_manifest" "internal_cert" {
  count = var.tls_enabled ? 1 : 0
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "internal-cert"
      namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
    }
    spec = {
      secretName = "internal-cert"
      issuerRef = {
        name = var.issuer
        kind = "ClusterIssuer"
      }
      commonName = "backend.ssh-locker-web.svc.cluster.local"
      dnsNames   = ["backend.ssh-locker-web.svc.cluster.local"]
    }
  }
}
resource "kubernetes_deployment" "ssh_locker_web" {
  metadata {
    name      = "backend"
    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
    labels = {
      app = "backend"
    }
    annotations = {
      "config/checksum" = local.config_checksum
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "backend"
      }
    }

    template {
      metadata {
        labels = {
          app = "backend"
        }
      }

      spec {
        security_context {
          run_as_user     = var.user_id
          run_as_group    = var.group_id
          fs_group        = var.group_id
          run_as_non_root = true
        }
        container {
          name  = "backend"
          image = "a13labs/ssh_locker_web:latest"

          security_context {
            allow_privilege_escalation = false
            read_only_root_filesystem  = true
          }

          port {
            container_port = var.tls_enabled ? 8443 : 8080
            name           = var.tls_enabled ? "https" : "http"
          }

          readiness_probe {
            tcp_socket {
              port = var.tls_enabled ? 8443 : 8080
            }
          }

          liveness_probe {
            tcp_socket {
              port = var.tls_enabled ? 8443 : 8080
            }
          }

          volume_mount {
            name       = "config-volume"
            mount_path = "/app/config.json"
            sub_path   = "config.json"
            read_only  = true
          }

          volume_mount {
            name       = "socket-volume"
            mount_path = "/app/socket"
          }

          dynamic "volume_mount" {
            for_each = var.tls_enabled ? [1] : []
            content {
              name       = "internal-cert"
              mount_path = "/etc/ssl/certs/private"
              read_only  = true
            }

          }
        }

        volume {
          name = "config-volume"
          secret {
            secret_name = kubernetes_secret.ssh_locker_web.metadata[0].name
            items {
              key  = "config.json"
              path = "config.json"
            }
          }
        }

        volume {
          name = "socket-volume"
          host_path {
            path = var.socket_path
          }
        }

        dynamic "volume" {
          for_each = var.tls_enabled ? [1] : []
          content {
            name = "internal-cert"
            secret {
              secret_name = "internal-cert"
              items {
                key  = "tls.crt"
                path = "tls.crt"
              }
              items {
                key  = "tls.key"
                path = "tls.key"
              }
            }
          }
        }

        service_account_name = kubernetes_service_account.ssh_locker_web.metadata[0].name
      }
    }
  }
}

resource "kubernetes_service" "backend" {
  metadata {
    name      = "backend"
    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
  }

  spec {
    selector = {
      app = "backend"
    }

    port {
      name        = var.tls_enabled ? "https" : "http"
      port        = var.tls_enabled ? 443 : 80
      target_port = var.tls_enabled ? 8443 : 8080
    }

    type = "ClusterIP"
  }
}