---
# OpenLDAP Deployment for OpenCloud
# Provides external LDAP directory for user and group storage
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# OpenLDAP Data Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openldap-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 10Gi
---
# OpenLDAP Config Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openldap-config
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 1Gi
---
# OpenLDAP Service
apiVersion: v1
kind: Service
metadata:
  name: openldap
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: openldap
  ports:
    - name: ldap
      port: 389
      targetPort: 389
      protocol: TCP
    - name: ldaps
      port: 636
      targetPort: 636
      protocol: TCP
---
# OpenLDAP Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openldap
  namespace: opencloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openldap
  template:
    metadata:
      labels:
        app: openldap
    spec:
      containers:
      - name: openldap
        image: osixia/openldap:1.5.0
        env:
        # Organization and domain
        - name: LDAP_ORGANISATION
          value: "BasicStack"
        - name: LDAP_DOMAIN
          value: "basicstack.de"

        # Admin credentials
        - name: LDAP_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: admin-password

        # Config admin password
        - name: LDAP_CONFIG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: config-password

        # Base DN will be: dc=basicstack,dc=de
        # Admin DN will be: cn=admin,dc=basicstack,dc=de

        # Logging
        - name: LDAP_LOG_LEVEL
          value: "256"

        # TLS disabled for internal cluster communication
        - name: LDAP_TLS
          value: "false"

        # Remove default database and start fresh
        - name: LDAP_REMOVE_CONFIG_AFTER_SETUP
          value: "false"

        lifecycle:
          postStart:
            exec:
              command:
                - /bin/bash
                - -c
                - |
                  # Wait for slapd to initialize
                  sleep 10
                  # Load OpenCloud schema if not already present
                  if ! ldapsearch -Y EXTERNAL -H ldapi:/// \
                    -b "cn=schema,cn=config" \
                    "(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
                    ldapadd -Y EXTERNAL -H ldapi:/// \
                      -f /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif \
                      2>&1 | tee /tmp/schema-load.log || true
                    echo "OpenCloud schema load attempted"
                  else
                    echo "OpenCloud schema already present, skipping"
                  fi

        ports:
        - containerPort: 389
          name: ldap
        - containerPort: 636
          name: ldaps

        volumeMounts:
        - name: openldap-data
          mountPath: /var/lib/ldap
        - name: openldap-config
          mountPath: /etc/ldap/slapd.d
        - name: opencloud-schema
          mountPath: /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif
          subPath: 10_opencloud_schema.ldif

        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        livenessProbe:
          tcpSocket:
            port: 389
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5

        readinessProbe:
          tcpSocket:
            port: 389
          initialDelaySeconds: 20
          periodSeconds: 5
          timeoutSeconds: 3

      volumes:
      - name: openldap-data
        persistentVolumeClaim:
          claimName: openldap-data
      - name: openldap-config
        persistentVolumeClaim:
          claimName: openldap-config
      - name: opencloud-schema
        configMap:
          name: opencloud-ldap-schema