---
# One-shot Job to load the OpenCloud LDAP schema into the running OpenLDAP instance.
# Connect via network LDAP as cn=admin,cn=config (rootdn of the config database).
# Re-run by deleting and recreating the Job; idempotent (exits 0 if schema already present).
apiVersion: batch/v1
kind: Job
metadata:
  name: opencloud-ldap-schema-loader
  namespace: opencloud
spec:
  ttlSecondsAfterFinished: 86400
  backoffLimit: 10
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: schema-loader
        image: osixia/openldap:1.5.0
        command:
          - /bin/bash
          - -c
          - |
            set -e

            echo "Waiting for OpenLDAP to be ready..."
            until ldapsearch -x -H ldap://openldap:389 \
              -D "cn=admin,dc=basicstack,dc=de" \
              -w "$LDAP_ADMIN_PASSWORD" \
              -b "dc=basicstack,dc=de" \
              -s base "(objectClass=*)" dn 2>&1 | grep -q "result: 0"; do
              echo "Not ready yet, retrying in 5s..."
              sleep 5
            done
            echo "OpenLDAP is ready"

            if ldapsearch -x -H ldap://openldap:389 \
              -D "cn=admin,cn=config" \
              -w "$LDAP_CONFIG_PASSWORD" \
              -b "cn=schema,cn=config" \
              "(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
              echo "OpenCloud schema already present, nothing to do"
              exit 0
            fi

            echo "Loading OpenCloud LDAP schema..."
            ldapadd -x -H ldap://openldap:389 \
              -D "cn=admin,cn=config" \
              -w "$LDAP_CONFIG_PASSWORD" \
              -f /schemas/10_opencloud_schema.ldif
            echo "OpenCloud schema loaded successfully"
        env:
        - name: LDAP_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: admin-password
        - name: LDAP_CONFIG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: config-password
        volumeMounts:
        - name: schemas
          mountPath: /schemas
      volumes:
      - name: schemas
        configMap:
          name: opencloud-ldap-schema