resource "kubernetes_secret" "geoip_maxmind_credentials" {
  metadata {
    name      = "geoip-maxmind-credentials"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
  }
  data = {
    account_id  = var.maxmind_account_id
    license_key = var.maxmind_license_key
  }
  type = "Opaque"
}

resource "kubernetes_cron_job_v1" "geoip_update" {

  metadata {
    name      = "geoip-update"
    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
  }

  spec {
    schedule = local.geoip_cron_schedule
    job_template {
      metadata {
        name = "geoip-update"
      }
      spec {
        template {
          metadata {
            labels = {
              app = "geoip-update"
            }
          }
          spec {
            container {
              name  = "geoip-update"
              image = "${local.geoip_image}:${local.geoip_version}"

              env {
                name = "GEOIPUPDATE_ACCOUNT_ID"
                value_from {
                  secret_key_ref {
                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
                    key  = "account_id"
                  }
                }
              }

              env {
                name = "GEOIPUPDATE_LICENSE_KEY"
                value_from {
                  secret_key_ref {
                    name = kubernetes_secret.geoip_maxmind_credentials.metadata[0].name
                    key  = "license_key"
                  }
                }
              }

              env {
                name  = "GEOIPUPDATE_EDITION_IDS"
                value = join(" ", local.geoip_editions)
              }

              resources {
                requests = {
                  memory = "64Mi"
                }
              }

              volume_mount {
                name       = "geoip-db"
                mount_path = "/usr/share/GeoIP"
              }


              security_context {
                run_as_user  = 1000
                run_as_group = 1000
              }
            }

            service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name

            restart_policy = "OnFailure"

            volume {
              name = "geoip-db"
              host_path {
                path = local.geoip_path
              }
            }
          }
        }
      }
    }
  }
}