apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "home-assistant.fullname" . }}
  {{- if .Values.namespaceOverride }}
  namespace: {{ .Values.namespaceOverride }}
  {{- end }}
  annotations:
    version-source: github-release:home-assistant/core
  labels:
    {{- include "home-assistant.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  strategy:
    type: Recreate
  selector:
    matchLabels:
      {{- include "home-assistant.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "home-assistant.selectorLabels" . | nindent 8 }}
    spec:
      {{- if .Values.hostNetwork }}
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}
      initContainers:
        - name: init-config
          image: busybox:latest
          command:
            - /bin/sh
            - -c
            - |
              # Redirect HA log files to container stdout
              rm -f /config/home-assistant.log /config/home-assistant.log.1
              ln -sf /dev/stdout /config/home-assistant.log
              ln -sf /dev/null /config/home-assistant.log.1
          volumeMounts:
            - name: config
              mountPath: /config
        {{- if .Values.haSecrets.enabled }}
        - name: init-secrets
          image: busybox:latest
          command:
            - /bin/sh
            - -c
            - |
              # Build secrets.yaml from mounted K8s secret
              echo "# Managed by Helm - do not edit manually" > /config/secrets.yaml
              for f in /ha-secrets/*; do
                key=$(basename "$f")
                val=$(cat "$f")
                echo "$key: \"$val\"" >> /config/secrets.yaml
              done
          volumeMounts:
            - name: config
              mountPath: /config
            - name: ha-secrets
              mountPath: /ha-secrets
              readOnly: true
        {{- end }}
        {{- if .Values.postgres.enabled }}
        - name: init-recorder
          image: busybox:latest
          command:
            - /bin/sh
            - -c
            - |
              # Build recorder.yaml with postgres connection string
              printf '%s\n' \
                "db_url: \"postgresql://{{ .Values.postgres.user }}:${HA_POSTGRESQL_PASSWORD}@{{ .Values.postgres.host }}:{{ .Values.postgres.port }}/{{ .Values.postgres.db }}\"" \
                "db_retry_wait: 15" \
                "auto_purge: true" \
                "purge_keep_days: {{ .Values.postgres.purgeKeepDays | default 30 }}" \
                > /config/recorder.yaml
              # Ensure configuration.yaml includes recorder.yaml
              if ! grep -q 'recorder.yaml' /config/configuration.yaml 2>/dev/null; then
                echo "" >> /config/configuration.yaml
                echo "recorder: !include recorder.yaml" >> /config/configuration.yaml
              fi
          env:
            - name: HA_POSTGRESQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.postgres.existingSecret }}
                  key: {{ .Values.postgres.passwordKey }}
          volumeMounts:
            - name: config
              mountPath: /config
        {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: 8123
              protocol: TCP
            {{- if .Values.homekit.enabled }}
            - name: homekit
              containerPort: {{ .Values.homekit.port }}
              protocol: TCP
            {{- end }}
          env:
            - name: TZ
              value: {{ .Values.timezone | quote }}
          volumeMounts:
            {{- if .Values.persistence.config.enabled }}
            - name: config
              mountPath: {{ .Values.persistence.config.mountPath }}
            {{- end }}
            {{- if .Values.persistence.media.enabled }}
            - name: media
              mountPath: {{ .Values.persistence.media.mountPath }}
            {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
        {{- if .Values.persistence.config.enabled }}
        - name: config
          {{- if eq .Values.persistence.config.type "hostPath" }}
          hostPath:
            path: {{ .Values.persistence.config.hostPath }}
            type: DirectoryOrCreate
          {{- else }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.config.existingClaim | default (include "home-assistant.fullname" .) }}
          {{- end }}
        {{- end }}
        {{- if .Values.persistence.media.enabled }}
        - name: media
          hostPath:
            path: {{ .Values.persistence.media.hostPath }}
            type: DirectoryOrCreate
        {{- end }}
        {{- if .Values.haSecrets.enabled }}
        - name: ha-secrets
          secret:
            secretName: {{ .Values.haSecrets.existingSecret }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}