resource "kubernetes_service_account" "llm_proxy" {

  count = var.llm_proxy.enabled ? 1 : 0
  metadata {
    name      = "llm-proxy-sa"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_deployment" "llm_proxy" {

  count = var.llm_proxy.enabled ? 1 : 0
  metadata {
    name      = "llm-proxy"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
    labels = {
      app = "llm-proxy"
    }
  }

  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "llm-proxy"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          app = "llm-proxy"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
        automount_service_account_token = false

        host_network = true
        container {
          name              = "app"
          image             = "a13labs/wol_proxy:v0.4.0"
          image_pull_policy = "Always"

          security_context {
            capabilities {
              add = ["NET_RAW"]
            }
          }

          port {
            name           = "http"
            container_port = var.llm_proxy.port
          }

          env {
            name  = "UPSTREAM_MAC"
            value = var.llm_proxy.mac
          }

          env {
            name  = "UPSTREAM_IP"
            value = var.llm_proxy.ip
          }

          env {
            name  = "UPSTREAM_PORT"
            value = try(var.llm_proxy.upstream_port, var.llm_proxy.port)
          }

          env {
            name  = "UPSTREAM_SCHEME"
            value = var.llm_proxy.scheme
          }

          env {
            name  = "PROXY_PORT"
            value = var.llm_proxy.port
          }

          readiness_probe {
            tcp_socket {
              port = var.llm_proxy.port
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            failure_threshold     = 10
          }
        }
      }
    }
  }
}