{{- /*
FerretDB — MongoDB-wire-compatible front-end backed by Postgres for the
SME microservice mesh (issue #861).

Why this template exists:
  Three SME services (catalog, tenant, domain) and provisioning use a
  MongoDB-wire driver to talk to a `ferretdb.sme.svc.cluster.local:27017`
  service. On contabo-mkt this Deployment is shipped via
  clusters/contabo-mkt/apps/sme/data/ferretdb.yaml. On a freshly
  franchised Sovereign nothing equivalent exists, so 4 of the 11 SME
  pods crashloop with `failed to ping MongoDB error=...lookup
  ferretdb.sme.svc.cluster.local on 10.43.0.10:53: no such host`.
  Caught live on otech103 (2026-05-04) after #859 landed sme-pg —
  every SME pod that uses MONGODB_URI was still down.

Image pinning:
  ghcr.io/ferretdb/ferretdb:1.24 mirrors contabo's data/ferretdb.yaml.

  WHY v1.24 NOT v2.x: FerretDB v2.x requires PostgreSQL with the
  DocumentDB extension (microsoft/documentdb fork). The sme-pg CNPG
  Cluster from #859/PR #860 uses ghcr.io/cloudnative-pg/postgresql:16
  which ships vanilla Postgres without that extension — so a v2 image
  would error out on first connect. v1.24 works against vanilla
  Postgres and is the proven path on contabo. Bumping to v2 is a
  separate change that needs a custom CNPG image AND a values toggle
  to switch the imageName on sme-pg.

Backing-store wiring:
  FERRETDB_POSTGRESQL_URL points at the sme-pg-rw read/write Service
  in this namespace. Credentials come from the sme-pg-app Secret CNPG
  auto-creates in 1.4.3 (key names `username` + `password`). The DSN
  interpolates them via Pod env-var-in-env-var substitution
  ($(PG_USER)/$(PG_PASSWORD)) so the plaintext password never appears
  in the Deployment manifest (Inviolable Principle #10 — no plaintext
  credentials in source).

  The connection target DB `sme_documents` is created by the
  cnpg-cluster.yaml's postInitApplicationSQL block (1.4.4 extension)
  alongside sme_billing.

  sslmode=disable matches contabo's Deployment — sme-pg-rw is a
  ClusterIP Service, traffic stays inside Cilium overlay encryption,
  and CNPG's default issuer chain isn't trusted by FerretDB's bundled
  PG client without extra config. Per-Sovereign overlays may flip
  to require/verify-full via .Values.smeServices.ferretdb.sslmode if
  the operator wires the CNPG CA into the FerretDB pod (separate
  follow-up).

Per Inviolable Principle #4 (never hardcode), every operationally-
meaningful value flows through .Values.smeServices.ferretdb.* and
.Values.smePostgres.* — image, tag, resources, sslmode, target DB
name. Defaults match contabo's known-working shape so a fresh
Sovereign install renders cleanly without operator input.
*/}}
{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
{{- $ferret := .Values.smeServices.ferretdb -}}
{{- $ns := $ferret.namespace | default "sme" -}}
{{- $pgService := printf "%s-rw.%s.svc.cluster.local" (.Values.smePostgres.cluster.name | default "sme-pg") $ns -}}
{{- $pgPort := $ferret.postgresPort | default 5432 -}}
{{- $pgDB := $ferret.postgresDatabase | default "sme_documents" -}}
{{- $sslmode := $ferret.sslmode | default "disable" -}}
{{- $appSecret := printf "%s-app" (.Values.smePostgres.cluster.name | default "sme-pg") -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ferretdb
  namespace: {{ $ns }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: sme-ferretdb
    app.kubernetes.io/part-of: sme
spec:
  replicas: {{ $ferret.replicas | default 1 }}
  selector:
    matchLabels:
      app: sme-ferretdb
  template:
    metadata:
      labels:
        app: sme-ferretdb
        catalyst.openova.io/component: sme-ferretdb
        app.kubernetes.io/part-of: sme
    spec:
      containers:
        - name: ferretdb
          image: {{ printf "%s:%s" ($ferret.image | default "ghcr.io/ferretdb/ferretdb") ($ferret.tag | default "1.24") | quote }}
          imagePullPolicy: {{ $ferret.imagePullPolicy | default "IfNotPresent" }}
          ports:
            - containerPort: 27017
              name: mongo
          env:
            # Pull username/password from CNPG-managed sme-pg-app Secret
            # (auto-created in 1.4.3 — see cnpg-cluster.yaml). Names
            # `username` / `password` are CNPG defaults; do not override.
            - name: PG_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $appSecret }}
                  key: username
            - name: PG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ $appSecret }}
                  key: password
            # FerretDB v1.x reads FERRETDB_POSTGRESQL_URL as its
            # connection string. Pod env-var substitution
            # ($(PG_USER)/$(PG_PASSWORD)) keeps the plaintext password
            # out of the Deployment manifest (Inviolable Principle #10).
            - name: FERRETDB_POSTGRESQL_URL
              value: "postgres://$(PG_USER):$(PG_PASSWORD)@{{ $pgService }}:{{ $pgPort }}/{{ $pgDB }}?sslmode={{ $sslmode }}"
          resources:
            {{- toYaml ($ferret.resources | default (dict "requests" (dict "cpu" "25m" "memory" "64Mi") "limits" (dict "cpu" "500m" "memory" "256Mi"))) | nindent 12 }}
          livenessProbe:
            tcpSocket:
              port: 27017
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: 27017
            initialDelaySeconds: 10
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: ferretdb
  namespace: {{ $ns }}
  labels:
    catalyst.openova.io/blueprint: bp-catalyst-platform
    catalyst.openova.io/component: sme-ferretdb
    app.kubernetes.io/part-of: sme
spec:
  selector:
    app: sme-ferretdb
  ports:
    - name: mongo
      port: 27017
      targetPort: 27017
{{- end }}
