resource "kubernetes_service_account" "devolo_exporter" {
  metadata {
    name      = "devolo-exporter-sa-${var.devolo_model}"
    namespace = var.namespace
  }
}

resource "kubernetes_config_map" "devolo_exporter" {
  metadata {
    name      = "devolo-exporter-config-${var.devolo_model}"
    namespace = var.namespace
  }
  data = {
    "exporter.py"      = local.exporter_script
    "requirements.txt" = local.requirements_txt
  }
}

resource "kubernetes_deployment" "devolo_exporter" {
  metadata {
    name      = "devolo-exporter-${var.devolo_model}"
    namespace = var.namespace
    labels = {
      app = "devolo-exporter-${var.devolo_model}"
    }
  }
  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "devolo-exporter-${var.devolo_model}"
      }
    }
    strategy {
      type = "RollingUpdate"
    }
    template {
      metadata {
        labels = {
          app = "devolo-exporter-${var.devolo_model}"
        }
        annotations = {
          "checksum/exporter"     = local.exporter_checksum
          "checksum/requirements" = local.requirements_checksum
        }
      }
      spec {
        service_account_name            = kubernetes_service_account.devolo_exporter.metadata[0].name
        automount_service_account_token = false

        container {
          name    = "devolo-exporter"
          image   = "python:${var.tag}"
          command = ["sh", "-c", join(" && ", local.commands)]

          env {
            name  = "EXPORTER_PORT"
            value = tostring(var.exporter_port)
          }
          env {
            name  = "DEVOLO_IP"
            value = var.devolo_ip
          }
          env {
            name  = "RD_PORT"
            value = tostring(var.rd_port)
          }
          port {
            container_port = var.exporter_port
            name           = "http-metrics"
          }

          liveness_probe {
            http_get {
              path = "/healthz"
              port = var.exporter_port
            }
            initial_delay_seconds = 10
            period_seconds        = 10
            timeout_seconds       = 5
            failure_threshold     = 3
          }

          readiness_probe {
            http_get {
              path = "/healthz"
              port = var.exporter_port
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            timeout_seconds       = 5
            failure_threshold     = 3
          }

          volume_mount {
            name       = "exporter-volume"
            mount_path = "/exporter"
            read_only  = true
          }

          volume_mount {
            name       = "tmp"
            mount_path = "/tmp"
          }

          security_context {
            run_as_user               = 0
            run_as_group              = 0
            read_only_root_filesystem = true
          }
        }

        # Chromium sidecar providing the DevTools endpoint used by the exporter
        container {
          name    = "chromium"
          image   = "nextools/chromium:latest"
          command = ["/usr/bin/chromium-browser"]
          args = [
            "--disable-background-networking",
            "--disable-background-timer-throttling",
            "--disable-backgrounding-occluded-windows",
            "--disable-renderer-backgrounding",
            "--disable-breakpad",
            "--disable-client-side-phishing-detection",
            "--disable-default-apps",
            "--disable-dev-shm-usage",
            "--disable-extensions",
            "--disable-gpu",
            "--disable-popup-blocking",
            "--disable-prompt-on-repost",
            "--disable-sync",
            "--disable-translate",
            "--headless",
            "--hide-scrollbars",
            "--ignore-certificate-errors",
            "--ignore-certificate-errors-spki-list",
            "--ignore-ssl-errors",
            "--metrics-recording-only",
            "--mute-audio",
            "--no-first-run",
            "--no-sandbox",
            "--remote-debugging-address=0.0.0.0",
            "--remote-debugging-port=${var.rd_port}",
            "--remote-allow-origins=http://localhost:9222",
            "--safebrowsing-disable-auto-update",
            "--user-data-dir=/home/chromium",
            "http://${var.devolo_ip}/#/overview"
          ]

          # Optional: expose the DevTools port within the pod (not needed outside)
          port {
            container_port = var.rd_port
            name           = "devtools"
          }

          volume_mount {
            name       = "chromium-data"
            mount_path = "/home/chromium"
          }

          volume_mount {
            name       = "tmp"
            mount_path = "/tmp"
          }

          security_context {
            run_as_user               = 0
            run_as_group              = 0
            read_only_root_filesystem = true
          }
        }

        volume {
          name = "exporter-volume"
          config_map {
            name = kubernetes_config_map.devolo_exporter.metadata[0].name
          }
        }

        # Writable /tmp for venv/site-packages installed under /tmp/python
        volume {
          name = "tmp"
          empty_dir {}
        }
        volume {
          name = "chromium-data"
          empty_dir {}
        }
      }
    }
  }
}

resource "kubernetes_service" "devolo_exporter" {
  metadata {
    name      = "devolo-exporter-${var.devolo_model}"
    namespace = var.namespace
    labels = {
      app = "devolo-exporter-${var.devolo_model}"
    }
  }
  spec {
    selector = {
      app = "devolo-exporter-${var.devolo_model}"
    }
    port {
      port        = var.exporter_port
      target_port = var.exporter_port
      protocol    = "TCP"
      name        = "http-metrics"
    }
    type = "ClusterIP"
  }
}