resource "kubernetes_service" "nextcloud_apache" {
  metadata {
    name      = "http"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  spec {
    port {
      port        = var.tls_enabled ? 443 : 80
      target_port = var.tls_enabled ? 443 : 80
    }
    selector = {
      app = "nextcloud"
    }
    cluster_ip = "None"
  }
}

resource "kubernetes_ingress_v1" "nextcloud_ingress" {
  depends_on = [
    kubernetes_deployment.nextcloud_apache
  ]
  metadata {
    name      = "ingress"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name

    annotations = merge({
      "kubernetes.io/ingress.class"                         = "public"
      "cert-manager.io/cluster-issuer"                      = "letsencrypt-prod"
      "kubernetes.io/tls-acme"                              = "true"
      "nginx.ingress.kubernetes.io/ssl-redirect"            = "true"
      "nginx.ingress.kubernetes.io/proxy-body-size"         = "4G"
      "nginx.ingress.kubernetes.io/proxy-request-buffering" = "on"
      "nginx.ingress.kubernetes.io/proxy-buffer-size"       = "32k"
      "nginx.ingress.kubernetes.io/proxy-buffers-number"    = "16"
      "nginx.ingress.kubernetes.io/server-snippet"          = file("${path.module}/resources/nextcloud-server-snippet.conf")
      },
      var.tls_enabled ? {
        "nginx.org/ssl-services"                       = "http"
        "nginx.org/ssl-redirect"                       = "true"
        "nginx.org/redirect-to-https"                  = "true"
        "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
      } : {}
    )
  }
  spec {
    tls {
      hosts       = [var.fqdn]
      secret_name = "nextcloud-tls"
    }
    rule {
      host = var.fqdn
      http {
        path {
          backend {
            service {
              name = "http"
              port {
                number = var.tls_enabled ? 443 : 80
              }
            }
          }
        }
      }
    }
  }
}