---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: celery
  namespace: django
spec:
  interval: 10m
  chart:
    spec:
      chart: universal-chart
      version: "0.1.9"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    global:
      env: _default
    services:
      celery:
        enabled: true
        serviceAccount:
          enabled:
            _default: true
          name:
            _default: django-vault
        deployment:
          enabled: true
          name:
            _default: celery
          replicaCount:
            _default: 1
          port:
            _default: 8000
          command:
            _default: ["/bin/sh", "-ec"]
          args:
            _default:
              - |
                set -a
                [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
                [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
                [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
                [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
                [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
                [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
                set +a
                exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
          resources:
            requests:
              cpu:
                _default: 25m
              memory:
                _default: 128Mi
          probes:
            liveness:
              enabled: false
            readiness:
              enabled: false
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
          pullPolicy:
            _default: IfNotPresent
        service:
          enabled: false
        imagePullSecrets:
          enabled:
            _default: true
          name:
            _default: regcred
        volumes:
          _default:
            - name: django-configmap
              mountPath:
                _default: /opt/sarex/config/settings/production.py
              subPath:
                _default: production.py
              readOnly:
                _default: true
              configMap:
                name:
                  _default: django-configmap
                items:
                  - key: production.py
                    path:
                      _default: production.py
        envs:
          - name: ALLOWED_HOSTS
            value:
              _default: "*"
          - name: SERVER_USE_CHANGELOG
            value:
              _default: "0"
          - name: SERVER_ZITADEL_ENABLED
            value:
              _default: "False"
          - name: DJANGO_SETTINGS_MODULE
            value:
              _default: config.settings.production
          - name: CELERY_REDIS_HOST
            value:
              _default: redis
          - name: CELERY_REDIS_PORT
            value:
              _default: "6379"
          - name: DJANGO_REDIS_HOST
            value:
              _default: redis
          - name: DJANGO_REDIS_PORT
            value:
              _default: "6379"
          - name: BIMV2_INTERNAL_HOST
            value:
              _default: http://bim-backend-v2-service.bim-api
          - name: BIMV2_TIMEOUT
            value:
              _default: "60"
          - name: JWT_KID
            value:
              _default: "1"
          - name: PDM_SYNC
            value:
              _default: "1"
          - name: KC_SYNC_ENABLE
            value:
              _default: "0"
          - name: MEASUREMENTS_HOST
            value:
              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
          - name: MEASUREMENTS_USE_MEASUREMENTS
            value:
              _default: "1"
          - name: SERVER_API_HOST
            value:
              _default: https://wb.sarex.io
          - name: SERVER_HOST
            value:
              _default: https://wb.sarex.io
          - name: WORKFLOWS_HOST
            value:
              _default: https://wb.sarex.io
          - name: WORKFLOWS_BASE_HOST
            value:
              _default: https://wb.sarex.io
          - name: WORKFLOWS_USE
            value:
              _default: "1"
          - name: SERVER_S3_STREAM_IMPORT
            value:
              _default: "1"
          - name: SERVER_SAVE_DIFF_DEM
            value:
              _default: "1"
          - name: SERVER_USE_CLICKHOUSE
            value:
              _default: "0"
          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
            value:
              _default: "0"
          - name: SERVER_USE_DJANGO_STORAGE
            value:
              _default: "1"
          - name: SERVER_USE_METASHAPE
            value:
              _default: "0"
          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
            value:
              _default: "1"
          - name: SERVER_CHANGELOG_MODE
            value:
              _default: "0"
          - name: SERVER_DJANGO_URLS
            value:
              _default: "1"
          - name: CHECK_IMPORT_HASH
            value:
              _default: "1"
          - name: EAV_ENABLE
            value:
              _default: "1"
          - name: SERVER_CHECK_IMPORT_HASH
            value:
              _default: "1"
          - name: SERVER_CHUNKED_PATH
            value:
              _default: /tmp/chunked_uploads/%Y/%m/%d
          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
            value:
              _default: "0"
          - name: SERVER_USE_WRORKFLOW_STATUS
            value:
              _default: "1"
          - name: ZITADEL_HOST
            value:
              _default: https://zitadel-srx.wb.ru
          - name: SERVER_KAFKA_ENABLED
            value:
              _default: "False"
          - name: KAFKA_TOPICS
            value:
              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
          - name: KAFKA_SSL_CAFILE
            value:
              _default: /usr/local/share/ca-certificates/kafka.crt
          - name: KC_USE_REDIRECT_LOGOUT
            value:
              _default: "False"
        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
            vault.hashicorp.com/agent-init-first: "true"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/auth-path: auth/kubernetes
            vault.hashicorp.com/role: django
            vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
            vault.hashicorp.com/agent-inject-template-django-postgresql: |-
              {{- with secret "secrets/data/apps/django/postgres" -}}
              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
              DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
            vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
              {{- with secret "secrets/data/rabbitmq/apps/django" -}}
              CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
              CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
              CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
              CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
              DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
              DJANGO_RABBIT_USER={{ index .Data.data "username" }}
              DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
              DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
            vault.hashicorp.com/agent-inject-template-django-s3: |-
              {{- with secret "secrets/data/minio/apps/django" -}}
              AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
              S3_HOST=https://minio.contour.infra.sarex.tech
              {{- $buckets := index .Data.data "buckets" }}
              S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}}
              S3_LOGIN={{ index .Data.data "access_key" }}
              S3_PASSWORD={{ index .Data.data "secret_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
            vault.hashicorp.com/agent-inject-template-django-kafka: |-
              {{- with secret "secrets/data/kafka/apps/django" -}}
              KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
              KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
              KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
              KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
            vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
              {{ index .Data.data "private_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
            vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
              {{ index .Data.data "public_key" }}
              {{- end -}}
            vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
            vault.hashicorp.com/agent-inject-template-django-common: |-
              {{- with secret "secrets/data/vault/common/django_auth" -}}
              ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
              {{- end -}}
