{{- if and .Values.copilot.enabled .Values.copilot.postgresql.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "sim.fullname" . }}-copilot-postgresql-secret
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sim.copilotPostgresql.labels" . | nindent 4 }}
type: Opaque
stringData:
  POSTGRES_USER: {{ .Values.copilot.postgresql.auth.username | quote }}
  POSTGRES_PASSWORD: {{ required "copilot.postgresql.auth.password is required when copilot is enabled" .Values.copilot.postgresql.auth.password | quote }}
  POSTGRES_DB: {{ .Values.copilot.postgresql.auth.database | quote }}
  DATABASE_URL: "postgresql://{{ .Values.copilot.postgresql.auth.username }}:{{ .Values.copilot.postgresql.auth.password }}@{{ include "sim.fullname" . }}-copilot-postgresql:{{ .Values.copilot.postgresql.service.port }}/{{ .Values.copilot.postgresql.auth.database }}"
---
# ClusterIP Service used by client workloads
apiVersion: v1
kind: Service
metadata:
  name: {{ include "sim.fullname" . }}-copilot-postgresql
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sim.copilotPostgresql.labels" . | nindent 4 }}
spec:
  type: {{ .Values.copilot.postgresql.service.type }}
  ports:
    - port: {{ .Values.copilot.postgresql.service.port }}
      targetPort: {{ .Values.copilot.postgresql.service.targetPort }}
      protocol: TCP
      name: postgresql
  selector:
    {{- include "sim.copilotPostgresql.selectorLabels" . | nindent 4 }}
---
# Headless Service for the StatefulSet (stable per-pod DNS)
apiVersion: v1
kind: Service
metadata:
  name: {{ include "sim.fullname" . }}-copilot-postgresql-headless
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sim.copilotPostgresql.labels" . | nindent 4 }}
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - port: {{ .Values.copilot.postgresql.service.port }}
      targetPort: {{ .Values.copilot.postgresql.service.targetPort }}
      protocol: TCP
      name: postgresql
  selector:
    {{- include "sim.copilotPostgresql.selectorLabels" . | nindent 4 }}
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ include "sim.fullname" . }}-copilot-postgresql
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sim.copilotPostgresql.labels" . | nindent 4 }}
spec:
  # Must remain {{ include "sim.fullname" . }}-copilot-postgresql (not the
  # -headless name) — spec.serviceName is immutable on a StatefulSet, and
  # the prior chart shipped with this value. Same rationale as the main
  # postgresql STS; see statefulset-postgresql.yaml for details.
  serviceName: {{ include "sim.fullname" . }}-copilot-postgresql
  replicas: 1
  podManagementPolicy: OrderedReady
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      {{- include "sim.copilotPostgresql.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "sim.copilotPostgresql.selectorLabels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "sim.serviceAccountName" . }}
      automountServiceAccountToken: false
      {{- with .Values.copilot.postgresql.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- include "sim.podSecurityContext" .Values.copilot.postgresql | nindent 6 }}
      containers:
        - name: postgresql
          image: {{ include "sim.image" (dict "imageRoot" .Values.copilot.postgresql.image "global" .Values.global "chartAppVersion" .Chart.AppVersion) }}
          imagePullPolicy: {{ .Values.copilot.postgresql.image.pullPolicy }}
          ports:
            - name: postgresql
              containerPort: {{ .Values.copilot.postgresql.service.targetPort }}
              protocol: TCP
          env:
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          envFrom:
            - secretRef:
                name: {{ include "sim.fullname" . }}-copilot-postgresql-secret
          {{- if .Values.copilot.postgresql.startupProbe }}
          startupProbe:
            {{- toYaml .Values.copilot.postgresql.startupProbe | nindent 12 }}
          {{- end }}
          {{- if .Values.copilot.postgresql.livenessProbe }}
          livenessProbe:
            {{- toYaml .Values.copilot.postgresql.livenessProbe | nindent 12 }}
          {{- end }}
          {{- if .Values.copilot.postgresql.readinessProbe }}
          readinessProbe:
            {{- toYaml .Values.copilot.postgresql.readinessProbe | nindent 12 }}
          {{- end }}
          {{- with .Values.copilot.postgresql.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- include "sim.containerSecurityContext" .Values.copilot.postgresql | nindent 10 }}
          {{- if .Values.copilot.postgresql.persistence.enabled }}
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
              subPath: pgdata
          {{- end }}
  {{- if .Values.copilot.postgresql.persistence.enabled }}
  volumeClaimTemplates:
    - metadata:
        name: data
        labels:
          {{- include "sim.copilotPostgresql.labels" . | nindent 10 }}
      spec:
        accessModes:
          {{- range .Values.copilot.postgresql.persistence.accessModes }}
          - {{ . | quote }}
          {{- end }}
        {{- if .Values.copilot.postgresql.persistence.storageClass }}
        {{- if (eq "-" .Values.copilot.postgresql.persistence.storageClass) }}
        storageClassName: ""
        {{- else }}
        storageClassName: {{ .Values.copilot.postgresql.persistence.storageClass | quote }}
        {{- end }}
        {{- else if .Values.global.storageClass }}
        storageClassName: {{ .Values.global.storageClass | quote }}
        {{- end }}
        resources:
          requests:
            storage: {{ .Values.copilot.postgresql.persistence.size | quote }}
  {{- end }}
{{- end }}