# PostgreSQL dedicado do tenant (banco da aplicação + banco do Keycloak)
apiVersion: v1
kind: ConfigMap
metadata:
  name: pg-initdb
  namespace: plataforma-prod
data:
  01-keycloak.sql: |
    CREATE DATABASE keycloak;
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data
  namespace: plataforma-prod
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: local-path
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  namespace: plataforma-prod
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:16
          # TLS ligado, e pg_hba SEM regra `host` em claro — ver o ConfigMap
          # pg-hba-tls. Sem trocar `host` por `hostssl`, por o sslmode=require
          # no cliente NAO impede outro cliente de conectar em claro: o servidor
          # aceitaria os dois. O criterio "conexao sem TLS e recusada" e do lado
          # do servidor, e so esta linha o cumpre.
          args:
            - -c
            - ssl=on
            - -c
            - ssl_cert_file=/etc/postgres-tls/tls.crt
            - -c
            - ssl_key_file=/etc/postgres-tls/tls.key
            - -c
            - hba_file=/etc/postgres-hba/pg_hba.conf
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: athleticmap
            - name: POSTGRES_USER
              value: atm
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          volumeMounts:
            - name: tls
              mountPath: /etc/postgres-tls
              readOnly: true
            - name: hba
              mountPath: /etc/postgres-hba
              readOnly: true
            - name: data
              mountPath: /var/lib/postgresql/data
            - name: initdb
              mountPath: /docker-entrypoint-initdb.d
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "atm", "-d", "athleticmap"]
            initialDelaySeconds: 10
            periodSeconds: 5
      # fsGroup 999 = gid do postgres na imagem debian. E o que faz o Secret
      # montar como root:postgres, e sem isso o pod nao sobe.
      securityContext:
        fsGroup: 999
      volumes:
        - name: tls
          secret:
            secretName: postgres-tls
            # 0640 + fsGroup 999 = root:postgres, que e a UNICA combinacao que
            # funciona. Medido: root:root 0640 faz o Postgres morrer com
            # "could not load private key file: Permission denied" — o processo
            # roda como uid 999 e nao le arquivo do grupo root.
            defaultMode: 0640
        - name: hba
          configMap:
            name: pg-hba-tls
        - name: data
          persistentVolumeClaim:
            claimName: postgres-data
        - name: initdb
          configMap:
            name: pg-initdb
---
# pg_hba SEM nenhuma regra `host` em claro: quem chegar pela rede sem TLS leva
# "no pg_hba.conf entry ... no encryption" e nao conecta.
apiVersion: v1
kind: ConfigMap
metadata:
  name: pg-hba-tls
  namespace: plataforma-prod
data:
  pg_hba.conf: |
    # socket local: initdb, readinessProbe e administracao de dentro do pod
    local   all   all                trust
    # rede: so com TLS
    hostssl all   all   0.0.0.0/0    scram-sha-256
    hostssl all   all   ::/0         scram-sha-256
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: plataforma-prod
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432