---
# OpenLDAP Deployment for OpenCloud
# Provides external LDAP directory for user and group storage
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# OpenLDAP Data Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openldap-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 10Gi
---
# OpenLDAP Config Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openldap-config
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 1Gi
---
# OpenLDAP Service
apiVersion: v1
kind: Service
metadata:
  name: openldap
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: openldap
  ports:
    - name: ldap
      port: 389
      targetPort: 389
      protocol: TCP
    - name: ldaps
      port: 636
      targetPort: 636
      protocol: TCP
---
# OpenLDAP Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openldap
  namespace: opencloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openldap
  template:
    metadata:
      labels:
        app: openldap
    spec:
      containers:
      - name: openldap
        image: osixia/openldap:1.5.0
        env:
        # Organization and domain
        - name: LDAP_ORGANISATION
          value: "BasicStack"
        - name: LDAP_DOMAIN
          value: "basicstack.de"

        # Admin credentials
        - name: LDAP_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: admin-password

        # Config admin password
        - name: LDAP_CONFIG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: openldap-admin-secret
              key: config-password

        # Base DN will be: dc=basicstack,dc=de
        # Admin DN will be: cn=admin,dc=basicstack,dc=de

        # Logging
        - name: LDAP_LOG_LEVEL
          value: "256"

        # TLS disabled for internal cluster communication
        - name: LDAP_TLS
          value: "false"

        # Remove default database and start fresh
        - name: LDAP_REMOVE_CONFIG_AFTER_SETUP
          value: "false"

        ports:
        - containerPort: 389
          name: ldap
        - containerPort: 636
          name: ldaps

        volumeMounts:
        - name: openldap-data
          mountPath: /var/lib/ldap
        - name: openldap-config
          mountPath: /etc/ldap/slapd.d

        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        livenessProbe:
          tcpSocket:
            port: 389
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5

        readinessProbe:
          tcpSocket:
            port: 389
          initialDelaySeconds: 20
          periodSeconds: 5
          timeoutSeconds: 3

      volumes:
      - name: openldap-data
        persistentVolumeClaim:
          claimName: openldap-data
      - name: openldap-config
        persistentVolumeClaim:
          claimName: openldap-config