resource "kubernetes_secret" "getmail_config" {
  metadata {
    name      = "getmail-config"
    namespace = kubernetes_namespace.mail.metadata[0].name
  }

  data = local.getmail_config
  type = "Opaque"
}

resource "kubernetes_config_map_v1" "getmail_runner" {
  metadata {
    name      = "getmail-runner"
    namespace = kubernetes_namespace.mail.metadata[0].name
  }
  data = {
    "runner.py" = local.getmail_runner_script
  }
}

resource "kubernetes_deployment_v1" "fetch_emails" {
  metadata {
    namespace = kubernetes_namespace.mail.metadata[0].name
    name      = "fetch-emails"
    labels = {
      app = "fetch-emails"
    }
  }

  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "fetch-emails"
      }
    }
    template {
      metadata {
        labels = {
          app = "fetch-emails"
        }
        annotations = {
          "checksum/runner-script" = local.checksum_getmail_runner_script
        }
      }
      spec {
        container {
          name    = "getmail"
          image   = "a13labs/getmail6:${var.getmail_tag}"
          command = ["python3", "/runner/runner.py"]
          env {
            name  = "FETCH_INTERVAL_SECONDS"
            value = local.getmail_fetch_interval_seconds
          }

          volume_mount {
            name       = "getmail-config"
            mount_path = "/getmail"
            read_only  = true
          }
          volume_mount {
            name       = "getmail-cache"
            mount_path = "/var/getmail"
          }
          volume_mount {
            name       = "runner-script"
            mount_path = "/runner"
            read_only  = true
          }
          volume_mount {
            name       = "tmp"
            mount_path = "/tmp"
          }

          security_context {
            run_as_user               = 1000
            run_as_group              = 1000
            read_only_root_filesystem = true
          }

          # Basic liveness (process must still be running)
          liveness_probe {
            exec {
              command = ["bash", "-c", "pgrep -f runner.py > /dev/null"]
            }
            initial_delay_seconds = 30
            period_seconds        = 30
          }

          resources {
            requests = {
              cpu    = "20m"
              memory = "64Mi"
            }
            limits = {
              cpu    = "200m"
              memory = "256Mi"
            }
          }
        }

        volume {
          name = "getmail-config"
          secret {
            secret_name = kubernetes_secret.getmail_config.metadata[0].name
            dynamic "items" {
              for_each = local.getmail_jobs
              content {
                key  = "getmailrc_${items.value.name}"
                path = "getmailrc_${items.value.name}"
              }
            }
          }
        }

        volume {
          name = "getmail-cache"
          host_path {
            path = local.getmail_path
          }
        }

        volume {
          name = "runner-script"
          config_map {
            name = kubernetes_config_map_v1.getmail_runner.metadata[0].name
            items {
              key  = "runner.py"
              path = "runner.py"
            }
          }
        }
        volume {
          name = "tmp"
          empty_dir {}
        }
      }
    }
  }
}