variable "flake_ref" {
  type = string
}

variable "flake_sha" {
  type = string
}

job "gitea" {
  datacenters = [ "homelab-1" ]
  type = "service"

  constraint {
    attribute = "${attr.unique.hostname}"
    value = "blowhole"
  }

  group "svc" {
    count = 1

    volume "gitea-data" {
      type = "csi"
      source = "gitea-data"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    volume "gitea-db" {
      type = "csi"
      source = "gitea-db"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    restart {
      attempts = 5
      delay = "5s"
    }

    network {
      mode = "bridge"
    }

    service {
      name = "gitea"
      port = "3000"
      
      check {
	type = "http"
	address_mode = "alloc"
	path = "/"
	port = "3000"
	interval = "2s"
	timeout = "2s"
      }

      connect {
	sidecar_service {}
      }
    }

    task "app" {
      driver = "containerd-driver"

      volume_mount {
	volume = "gitea-data"
	destination = "/data/gitea"
	read_only = false
      }

      volume_mount {
	volume = "gitea-db"
	destination = "/var/lib/mysql"
	read_only = false
      }

      config {
	flake_ref = "${var.flake_ref}#nixngSystems.gitea.config.system.build.toplevel"
	flake_sha = var.flake_sha
	entrypoint = [ "init" ]
      }

      env {
	USER_UID = "5001"
	USER_GID = "5001"
      }

      resources {
	cpu = 500
	memory = 1024
      }

      vault {
	policies = ["gitea-policy"]
      }

      template {
	data = <<EOF
{{ with secret "kv/data/gitea" }}{{ .Data.data.secret_key }}{{ end }}
EOF
	destination = "secrets/secret_key"
      }

      template {
	data = <<EOF
{{ with secret "kv/data/gitea" }}{{ .Data.data.internal_token }}{{ end }}
EOF
	destination = "secrets/internal_token"
      }

      template {
	data = <<EOF
{{ with secret "kv/data/gitea" }}{{ .Data.data.jwt_secret }}{{ end }}
EOF
	destination = "secrets/jwt_secret"
      }

      template {
	data = <<EOF
{{ with secret "kv/data/gitea" }}{{ .Data.data.lfs_jwt_secret }}{{ end }}
EOF
	destination = "secrets/lfs_jwt_secret"
      }
    }
  }
}