{{- $name := include "cloudhost-app.name" . -}}
{{- $ns   := include "cloudhost-app.namespace" . -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $name }}
  namespace: {{ $ns }}
  labels:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  annotations:
    kubernetes.io/change-cause: {{ .Values.changeCause | default (printf "Deploy %s" .Values.app.image) | quote }}
spec:
  revisionHistoryLimit: 10
  replicas: {{ .Values.app.replicas }}
  selector:
    matchLabels:
      {{- include "cloudhost-app.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "cloudhost-app.labels" . | nindent 8 }}
    spec:
      imagePullSecrets:
        - name: registry-pull-secret
      containers:
        - name: {{ $name }}
          image: {{ .Values.app.image | quote }}
          imagePullPolicy: Always
          ports:
            - containerPort: {{ .Values.app.port }}
          {{- if and .Values.envVars (gt (len .Values.envVars) 0) }}
          envFrom:
            - secretRef:
                name: {{ $name }}-env
          {{- end }}
          env:
            {{- if and .Values.database.enabled (eq .Values.database.type "postgresql") }}
            - name: DB_HOST
              value: {{ include "cloudhost-app.dbDeploymentName" . }}
            - name: DB_PORT
              value: "5432"
            - name: DB_NAME
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
            - name: DATABASE_URL
              value: "postgresql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:5432/{{ include "cloudhost-app.dbName" . }}"
            {{- if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}
            - name: DB_DATABASE
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            {{- end }}
            {{- end }}
            {{- if and .Values.database.enabled (eq .Values.database.type "mysql") }}
            - name: DB_HOST
              value: {{ include "cloudhost-app.dbDeploymentName" . }}
            - name: DB_PORT
              value: "3306"
            - name: DB_NAME
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
            - name: DATABASE_URL
              value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
            {{- if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}
            - name: DB_DATABASE
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            {{- end }}
            {{- end }}
            {{- if and .Values.database.enabled (eq .Values.database.type "mariadb") }}
            - name: DB_HOST
              value: {{ include "cloudhost-app.dbDeploymentName" . }}
            - name: DB_PORT
              value: "3306"
            - name: DB_NAME
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
            - name: DATABASE_URL
              value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
            {{- if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}
            - name: DB_DATABASE
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            {{- end }}
            {{- end }}
            {{- if and .Values.database.enabled (eq .Values.database.type "mongodb") }}
            - name: DB_HOST
              value: {{ include "cloudhost-app.dbDeploymentName" . }}
            - name: DB_PORT
              value: "27017"
            - name: DB_NAME
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
            - name: MONGODB_URI
              value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
            - name: DATABASE_URL
              value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
            {{- if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}
            - name: DB_DATABASE
              value: {{ include "cloudhost-app.dbName" . }}
            - name: DB_USERNAME
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            {{- end }}
            {{- end }}
            {{- /* Redis connection env vars */}}
            {{- if .Values.redis.enabled }}
            - name: REDIS_HOST
              value: {{ printf "%s-redis" $name }}
            - name: REDIS_PORT
              value: "6379"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ printf "%s-redis-secret" $name }}
                  key: password
            - name: REDIS_URL
              value: "redis://:$(REDIS_PASSWORD)@{{ printf "%s-redis" $name }}:6379"
            {{- end }}
            {{- /* RabbitMQ connection env vars */}}
            {{- if .Values.rabbitmq.enabled }}
            - name: RABBITMQ_HOST
              value: {{ printf "%s-rabbitmq" $name }}
            - name: RABBITMQ_PORT
              value: "5672"
            - name: RABBITMQ_MANAGEMENT_PORT
              value: "15672"
            - name: RABBITMQ_USER
              valueFrom:
                secretKeyRef:
                  name: {{ printf "%s-rabbitmq-secret" $name }}
                  key: username
            - name: RABBITMQ_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ printf "%s-rabbitmq-secret" $name }}
                  key: password
            - name: AMQP_URL
              value: "amqp://$(RABBITMQ_USER):$(RABBITMQ_PASSWORD)@{{ printf "%s-rabbitmq" $name }}:5672"
            {{- end }}
            {{- /* WordPress-specific env vars (official image expects these) */}}
            {{- if and .Values.wordpress.enabled .Values.database.enabled }}
            - name: WORDPRESS_DB_HOST
              value: "{{ include "cloudhost-app.dbDeploymentName" . }}:{{ include "cloudhost-app.dbPort" . }}"
            - name: WORDPRESS_DB_NAME
              value: {{ include "cloudhost-app.dbName" . }}
            - name: WORDPRESS_DB_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: username
            - name: WORDPRESS_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
            - name: WORDPRESS_TABLE_PREFIX
              value: "wp_"
            {{- end }}
          resources:
            requests:
              cpu: {{ .Values.resources.cpuRequest | quote }}
              memory: {{ .Values.resources.memoryRequest | quote }}
            limits:
              cpu: {{ .Values.resources.cpuLimit | quote }}
              memory: {{ .Values.resources.memoryLimit | quote }}
          readinessProbe:
            tcpSocket:
              port: {{ .Values.app.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: {{ .Values.app.port }}
            initialDelaySeconds: 15
            periodSeconds: 10
            failureThreshold: 5
          volumeMounts:
            - name: app-storage
              mountPath: {{ include "cloudhost-app.storageMountPath" . | trim }}
            {{- if .Values.elasticsearch.enabled }}
            - name: app-logs
              mountPath: /var/log/app
            {{- end }}
        {{- if .Values.elasticsearch.enabled }}
        - name: fluent-bit
          image: fluent/fluent-bit:2.2
          resources:
            requests:
              cpu: "10m"
              memory: "32Mi"
            limits:
              cpu: "50m"
              memory: "64Mi"
          volumeMounts:
            - name: app-logs
              mountPath: /var/log/app
              readOnly: true
            - name: fluent-bit-config
              mountPath: /fluent-bit/etc
          env:
            - name: APP_NAME
              value: {{ $name }}
            - name: APP_NAMESPACE
              value: {{ $ns }}
            - name: ES_HOST
              value: "elasticsearch.logging.svc.cluster.local"
            - name: ES_PORT
              value: "9200"
            - name: ES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-credentials
                  key: ELASTIC_PASSWORD
                  optional: true
        {{- end }}
      volumes:
        - name: app-storage
          persistentVolumeClaim:
            claimName: {{ $name }}-storage
        {{- if .Values.elasticsearch.enabled }}
        - name: app-logs
          emptyDir: {}
        - name: fluent-bit-config
          configMap:
            name: {{ $name }}-fluent-bit-config
        {{- end }}