{{- $name := .Values.fullnameOverride | default "postgresql" -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ $name }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ $name }}
spec:
  serviceName: {{ $name }}
  replicas: 1
  selector:
    matchLabels:
      app: {{ $name }}
  template:
    metadata:
      labels:
        app: {{ $name }}
    spec:
      securityContext:
        # The official image starts as root, initialises the data directory,
        # then drops to the postgres user (uid 70 on the Alpine variant).
        # fsGroup makes the provisioned volume group-writable so that drop
        # still leaves the data directory usable.
        fsGroup: 70
      terminationGracePeriodSeconds: 60
      containers:
        - name: postgres
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args:
            - -c
            - shared_buffers={{ .Values.config.sharedBuffers }}
            - -c
            - max_connections={{ .Values.config.maxConnections }}
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.existingSecret }}
                  key: {{ .Values.secretKeys.username }}
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.existingSecret }}
                  key: {{ .Values.secretKeys.password }}
            - name: POSTGRES_DB
              value: {{ .Values.database | quote }}
            # PGDATA must be a SUBDIRECTORY of the mount, not the mount
            # itself: initdb refuses to run in a directory that already has
            # contents, and a freshly provisioned volume is not always empty.
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          ports:
            - name: postgres
              containerPort: 5432
              protocol: TCP
          # Run through a shell so the environment expands — Kubernetes does
          # not substitute $(VAR) inside exec probe commands.
          readinessProbe:
            exec:
              command: ["sh", "-c", 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" -h 127.0.0.1']
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
          livenessProbe:
            exec:
              command: ["sh", "-c", 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" -h 127.0.0.1']
            initialDelaySeconds: 30
            periodSeconds: 20
            timeoutSeconds: 5
            failureThreshold: 6
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
{{- if .Values.persistence.enabled }}
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: {{ .Values.persistence.storageClass | quote }}
        resources:
          requests:
            storage: {{ .Values.persistence.size | quote }}
{{- end }}