---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-backups
spec:
  storageClassName: {{ .Values.backup.pvc.storageClassName }}
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: {{ .Values.backup.pvc.size }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-backup-local
data:
  POSTGRES_DB: |-
  {{- range $database := .Values.postgresql.databases }}
    {{ $database }}
  {{- end }}{{ .Values.local.postgresDb | quote }}
  BACKUP_KEEP_DAYS: {{ .Values.local.backupKeepDays | quote }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-auth
stringData:
  POSTGRES_USER: {{ .Values.postgresql.auth.postgresqlUser }}
  POSTGRES_PASSWORD: {{ .Values.postgresql.auth.postgresqlPassword }}
---
{{- if .Values.rclone.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-rclone
data:
  {{ .Values.rclone.config | toYaml | nindent 2 }}
{{- end }}
---
{{- if .Values.rclone.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-rclone
stringData:
  {{ .Values.rclone.secret | toYaml | nindent 2 }}
{{- end }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-backup
  labels:
    {{- include "postgresql-rclone.labels" . | nindent 4 }}
spec:
  schedule: {{ .Values.backup.schedule }}
  startingDeadlineSeconds: 3600
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 10
  failedJobsHistoryLimit: 10
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          imagePullSecrets:
            {{- toYaml .Values.imagePullSecrets | nindent 12 }}
          volumes:
            - name: backups
              persistentVolumeClaim:
                claimName: {{ include "postgresql-rclone.fullname" . }}-backups
            - name: postgresql-auth
              secret:
                secretName: {{ include "postgresql-rclone.fullname" . }}-auth
            - name: local-config
              configMap:
                name: {{ include "postgresql-rclone.fullname" . }}-local
            {{- if .Values.rclone.enabled }}
            - name: rclone-auth
              secret:
                secretName: {{ include "postgresql-rclone.fullname" . }}-rclone
            - name: rclone-config
              configMap:
                name: {{ include "postgresql-rclone.fullname" . }}-rclone
            {{- end }}
          initContainers:
          - name: dump-databases
            image: "{{ .Values.local.image.repository }}:{{ .Values.local.image.tag }}"
            imagePullPolicy: {{ .Values.local.image.pullPolicy }}
            volumeMounts:
              - name: backups
                mountPath: /backups
              - name: local-config
                mountPath: /config
              - name: postgresql-auth
                mountPath: /secret
            env:
              - name: BACKUP_KEEP_DAYS
                valueFrom:
                  configMapKeyRef:
                    name: {{ include "postgresql-rclone.fullname" . }}-local
                    key: BACKUP_KEEP_DAYS
              - name: BACKUP_DIR
                value: /backups
              - name: POSTGRES_HOST
                value: {{ .Values.postgresql.host }}
              - name: POSTGRES_DB_FILE
                value: /config/POSTGRES_DB
              - name: POSTGRES_USER_FILE
                value: /secret/POSTGRES_USER
              - name: POSTGRES_PASSWORD_FILE
                value: /secret/POSTGRES_PASSWORD
            command: ["/backup.sh"]
          {{- if .Values.rclone.enabled }}
          - name: rclone
            image: "{{ .Values.rclone.image.repository }}:{{ .Values.rclone.image.tag }}"
            imagePullPolicy: {{ .Values.rclone.image.pullPolicy }}
            volumeMounts:
              - name: backups
                mountPath: /backups
              - name: rclone-config
                mountPath: /config
              - name: rclone-auth
                mountPath: /secret
            envFrom:
              - configMapRef:
                  name: {{ include "postgresql-rclone.fullname" . }}-rclone
              - secretRef:
                  name: {{ include "postgresql-rclone.fullname" . }}-rclone
            {{- if .Values.rclone.crypt.enabled }}
            env:
              - name: RCLONE_CRYPT_REMOTE
                value: ":s3:$(S3_BUCKET)/$(S3_PREFIX)/"
            {{- end }}
            {{- if .Values.rclone.crypt.enabled }}
            args: ["copy", "/backups/", ":crypt:"]
            {{- else }}
            args: ["copy", "/backups/", ":s3:$(S3_BUCKET)/$(S3_PREFIX)/"]
            {{- end }}
          {{- end }}
          containers:
          - name: show-dumps
            image: bash
            volumeMounts:
              - name: backups
                mountPath: /backups
            command: ["ls"]
            args: ["-alR", "/backups"]
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-restores
spec:
  storageClassName: {{ .Values.restore.pvc.storageClassName }}
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: {{ .Values.restore.pvc.size }}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "postgresql-rclone.fullname" . }}-restore
  labels:
    {{- include "postgresql-rclone.labels" . | nindent 4 }}
spec:
  template:
    spec:
      restartPolicy: OnFailure
      imagePullSecrets:
        {{- toYaml .Values.imagePullSecrets | nindent 12 }}
      volumes:
        - name: restores
          persistentVolumeClaim:
            claimName: {{ include "postgresql-rclone.fullname" . }}-restores
        {{- if .Values.rclone.enabled }}
        - name: rclone-auth
          secret:
            secretName: {{ include "postgresql-rclone.fullname" . }}-rclone
        - name: rclone-config
          configMap:
            name: {{ include "postgresql-rclone.fullname" . }}-rclone
        {{- end }}
      initContainers:
      {{- if .Values.rclone.enabled }}
      - name: rclone
        image: "{{ .Values.rclone.image.repository }}:{{ .Values.rclone.image.tag }}"
        imagePullPolicy: {{ .Values.rclone.image.pullPolicy }}
        volumeMounts:
          - name: restores
            mountPath: /restores
          - name: rclone-config
            mountPath: /config
          - name: rclone-auth
            mountPath: /secret
        envFrom:
          - configMapRef:
              name: {{ include "postgresql-rclone.fullname" . }}-rclone
          - secretRef:
              name: {{ include "postgresql-rclone.fullname" . }}-rclone
        {{- if .Values.rclone.crypt.enabled }}
        env:
          - name: RCLONE_CRYPT_REMOTE
            value: ":s3:$(S3_BUCKET)/$(S3_PREFIX)/last/"
        {{- end }}
        {{- if .Values.rclone.crypt.enabled }}
        args: ["copy", ":crypt:", "/restores/"]
        {{- else }}
        args: ["-v", "copy", ":s3:$(S3_BUCKET)/$(S3_PREFIX)/last/", "/restores/.work/"]
        {{- end }}
      {{- end }}
      - name: link-latest
        image: "{{ .Values.bash.image.repository }}:{{ .Values.bash.image.tag }}"
        imagePullPolicy: {{ .Values.bash.image.pullPolicy }}
        volumeMounts:
          - name: restores
            mountPath: /restores
        command:
          - bash
          - -cx
          - |-
            find /restores/.work -maxdepth 1 -mindepth 1 -name '*.sql.gz' | \
            sort | \
            awk '{split($1, a, /-([^-]*)-([^-]*)$/)} !uniq[a[1] a[2] a[3]]++' | \
            while read file; do \
              ln -f "$file" "/restores/"
            done
      - name: show-restores
        image: "{{ .Values.bash.image.repository }}:{{ .Values.bash.image.tag }}"
        imagePullPolicy: {{ .Values.bash.image.pullPolicy }}
        volumeMounts:
          - name: restores
            mountPath: /restores
        command: ["ls"]
        args: ["-alR", "/restores"]

      containers:
      - name: ready
        image: "{{ .Values.bash.image.repository }}:{{ .Values.bash.image.tag }}"
        imagePullPolicy: {{ .Values.bash.image.pullPolicy }}
        volumeMounts:
          - name: restores
            mountPath: /restores
        command:
          - bash
          - -cx
          - |-
            touch /restores/.restored