{{- if .Values.licenseProxy.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Values.licenseProxy.namePrefix }}
  labels: &labels
{{ include "deepgram-self-hosted.labels" . | indent 4}}
    app: deepgram-license-proxy
    {{- range $key, $val := .Values.licenseProxy.additionalLabels }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  {{- with .Values.licenseProxy.additionalAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  selector:
    matchLabels:
       app: deepgram-license-proxy
       {{ include "deepgram-self-hosted.selectorLabels" . }}
  replicas: {{ if .Values.licenseProxy.deploySecondReplica }}2{{ else }}1{{ end }}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: {{ .Values.licenseProxy.updateStrategy.rollingUpdate.maxSurge }}
  template:
    metadata:
      labels: *labels
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/license-proxy/license-proxy.config.yaml") . | sha256sum }}
    spec:
      {{- if .Values.global.pullSecretRef }}
      imagePullSecrets:
      - name: {{ .Values.global.pullSecretRef }}
      {{- end }}
      affinity:
        {{- toYaml .Values.licenseProxy.affinity | nindent 8 }}
      tolerations:
        {{- toYaml .Values.licenseProxy.tolerations | nindent 8 }}
      securityContext:
        {{- toYaml .Values.licenseProxy.securityContext | nindent 8 }}
      {{- if or .Values.licenseProxy.serviceAccount.create .Values.licenseProxy.serviceAccount.name }}
      serviceAccountName: {{ default (printf "%s-sa" .Values.licenseProxy.namePrefix) .Values.licenseProxy.serviceAccount.name }}
      {{- end }}
      containers:
      - name: {{ .Values.licenseProxy.namePrefix }}
        image: {{ .Values.licenseProxy.image.path }}:{{ .Values.licenseProxy.image.tag }}
        imagePullPolicy: {{ .Values.licenseProxy.image.pullPolicy }}
        envFrom:
        - secretRef:
            name: {{ required "Missing Deepgram self-hosted API key - see `global.deepgramSecretRef`" .Values.global.deepgramSecretRef }}
        command: [ "hermes" ]
        args: ["-v", "serve", "/etc/config/license-proxy.toml"]
        resources:
          requests:
            memory: "{{ .Values.licenseProxy.resources.requests.memory }}"
            cpu: "{{ .Values.licenseProxy.resources.requests.cpu }}"
          limits:
            memory: "{{ .Values.licenseProxy.resources.limits.memory }}"
            cpu: "{{ .Values.licenseProxy.resources.limits.cpu }}"
        volumeMounts:
        - name: license-proxy-config-volume
          mountPath: /etc/config
        ports:
        - name: primary
          containerPort: {{ .Values.licenseProxy.server.port }}
        - name: status
          containerPort: {{ .Values.licenseProxy.server.statusPort }}
        livenessProbe:
          tcpSocket:
            port: {{ .Values.licenseProxy.server.statusPort }}
          initialDelaySeconds: {{ .Values.licenseProxy.livenessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.licenseProxy.livenessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.licenseProxy.livenessProbe.timeoutSeconds }}
        readinessProbe:
          exec:
            command:
            - sh
            - -c
            - curl --silent http://localhost:{{ .Values.licenseProxy.server.statusPort }}/v1/status | grep --quiet -e '^{.*\"state\"\:\"\(Connected\|TrustBased\)\".*}$'
          initialDelaySeconds: {{ .Values.licenseProxy.readinessProbe.initialDelaySeconds }}
          periodSeconds: {{ .Values.licenseProxy.readinessProbe.periodSeconds }}
          timeoutSeconds: {{ .Values.licenseProxy.readinessProbe.timeoutSeconds }}
      volumes:
      - name: license-proxy-config-volume
        configMap:
          name: {{ .Values.licenseProxy.namePrefix }}-config
{{- end -}}