---
# Патч backend для контура УГМК — подключение к Kafka.
#
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
# podAnnotations — map, мержится по ключам, поэтому переопределён только
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: backend
  namespace: flows
spec:
  values:
    services:
      backend:
        deployment:
          args:
            _default:
              - |
                set -a
                [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
                [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
                [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
                [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
                [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
                [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
                set +a
                exec /opt/entrypoint.sh

        envs:
          - name: LOG_LEVEL
            value:
              _default: "DEBUG"

          - name: BASE_HOST
            value:
              _default: "https://srx.wb.ru"

          - name: CELERY_QUEUE
            value:
              _default: "flow"

          - name: EAV_HOST
            value:
              _default: "http://backend-svc.eav.svc.cluster.local:80"

          - name: DJANGO_HOST
            value:
              _default: "http://backend-svc.django.svc.cluster.local:80/api"

          - name: PLANNING_HOST
            value:
              _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"

          - name: PLANNING_USE
            value:
              _default: "True"

          - name: DOCUMENTATION_HOST
            value:
              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"

          - name: DOCUMENTATION_EXTERNAL_HOST
            value:
              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"

          - name: ENABLE_ANALYTICS
            value:
              _default: "1"

          - name: ENABLE_CELERY
            value:
              _default: "1"

          - name: ENABLE_MAILGUN
            value:
              _default: "0"

          - name: ENABLE_METRICS
            value:
              _default: "0"

          - name: FROM_EMAIL
            value:
              _default: "sarex@rwb.ru"

          - name: GATEWAY_URL
            value:
              _default: "http://pdm-svc.documentations.svc.cluster.local:80"

          - name: RESOURCE_URL
            value:
              _default: "http://iam-backend.iam.svc.cluster.local:8000"

          - name: SERVICE_HOST
            value:
              _default: "https://srx.wb.ru/flows/api/v1"

          - name: SMTP_HOST
            value:
              _default: "mail.rwb.ru"

          - name: CHECKLIST_HOST
            value:
              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"

          - name: SMTP_PORT
            value:
              _default: "465"

          - name: SYNC_RESOURCE_ID
            value:
              _default: "1"

          - name: TIMEOUT
            value:
              _default: "120"

          - name: WORKFLOWS_HOST
            value:
              _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"

          - name: WORKFLOWS_TIMEOUT
            value:
              _default: "60"

          - name: DOCUMENTATION_TIMEOUT
            value:
              _default: "60"

          - name: KAFKA_HOST
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"

          - name: KAFKA_SSL_CERT
            value:
              _default: |
                -----BEGIN CERTIFICATE-----
                MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
                NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
                MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
                h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
                D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
                tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
                Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
                GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
                Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
                A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
                QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
                KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
                kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
                TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
                fdA17/ibw6gFrH2b3vZKcx8D455V
                -----END CERTIFICATE-----

        podAnnotations:
          _default:
            vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
            vault.hashicorp.com/agent-inject-template-flows-kafka: |-
              {{- with secret "secrets/data/kafka/apps/flows" -}}
              KAFKA_USERNAME={{ index .Data.data "username" }}
              KAFKA_PASSWORD={{ index .Data.data "password" }}
              {{- end -}}