---
# PersistentVolumeClaim for OwnTracks Recorder
# apiVersion: v1
# kind: PersistentVolumeClaim
# metadata:
#   name: otrecorder-config-pvc
# spec:
#   accessModes:
#     - ReadWriteOnce
#   resources:
#     requests:
#       storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: otrecorder-store-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
---
# PersistentVolumeClaim for Mosquitto
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mosquitto-data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mosquitto-logs-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
# ExternalSecret for OwnTracks Recorder password
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: owntracks-mqtt-credentials
# spec:
#   refreshInterval: "15m"
#   secretStoreRef:
#     name: vault-backend
#     kind: ClusterSecretStore
#   target:
#     name: owntracks-mqtt-password
#     creationPolicy: Owner
#   data:
#     - secretKey: password
#       remoteRef:
#         key: kv/mqtt
#         property: password

---
# Deployment for OwnTracks Recorder
# apiVersion: apps/v1
# kind: Deployment
# metadata:
#   name: otrecorder
# spec:
#   replicas: 1
#   selector:
#     matchLabels:
#       app: otrecorder
#   template:
#     metadata:
#       labels:
#         app: otrecorder
#     spec:
#       containers:
#       - name: otrecorder
#         image: owntracks/recorder
#         ports:
#         - containerPort: 8083
#         env:
#         - name: OTR_HOST
#           value: "mqtt"
#         - name: OTR_PORT
#           value: "8883"
#         - name: OTR_USER
#           value: "ruben"
#         # - name: TZ
#           # value: "Europe/Berlin"
#         # - name: VIRTUAL_HOST
#           # value: "owntracks.hensen.io"
#         # - name: VIRTUAL_PORT
#           # value: 8883
#         # - name: OTR_CLIENTID
#           # value: ""
#         - name: OTR_PASS
#           valueFrom:
#             secretKeyRef:
#               name: owntracks-mqtt-password
#               key: password
#         volumeMounts:
#         - name: store
#           mountPath: /store
#       volumes:
#       - name: store
#         persistentVolumeClaim:
#           claimName: otrecorder-store-pvc
---
# Service for OwnTracks Recorder
# apiVersion: v1
# kind: Service
# metadata:
#   name: otrecorder
# spec:
#   selector:
#     app: otrecorder
#   ports:
#   - port: 8083
#     targetPort: 8083
#   type: ClusterIP
---
# ExternalSecret to fetch MQTT password file from Vault
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: mqtt-password-file
spec:
  refreshInterval: "15m"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: mqtt-password-secret
    creationPolicy: Owner
  data:
    - secretKey: password_file
      remoteRef:
        key: kv/mqtt
        property: secret

---
# ConfigMap for MQTT configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: mqtt-config
data:
  mosquitto.conf: |
    listener 8883
    allow_anonymous false
    password_file /mosquitto/config/password_file
    # Add other MQTT configuration options here
    listener 8083
    protocol websockets
---
# MQTT Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mqtt
  labels:
    app: mqtt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mqtt
  template:
    metadata:
      labels:
        app: mqtt
    spec:
      containers:
      - name: mqtt
        image: eclipse-mosquitto:latest
        ports:
        - containerPort: 8883
          name: mqtt
        - containerPort: 8083
          name: websocket
        volumeMounts:
        - name: config
          mountPath: /mosquitto/config/mosquitto.conf
          subPath: mosquitto.conf
        - name: password-file
          mountPath: /mosquitto/config/password_file
          subPath: password_file
      volumes:
      - name: config
        configMap:
          name: mqtt-config
      - name: password-file
        secret:
          secretName: mqtt-password-secret

---
# MQTT Service
apiVersion: v1
kind: Service
metadata:
  name: mqtt
spec:
  selector:
    app: mqtt
  ports:
  - port: 8883
    targetPort: 8883
    name: mqtt
  - port: 8083
    targetPort: 8083
    name: websocket
---
# External access with Ingress for OwnTracks Recorder
# apiVersion: networking.k8s.io/v1
# kind: Ingress
# metadata:
#   name: otrecorder-ingress
#   annotations:
#     nginx.ingress.kubernetes.io/rewrite-target: /
#     cert-manager.io/cluster-issuer: prod-cluster-issuer
# spec:
#   ingressClassName: nginx
#   tls:
#   - hosts:
#     - owntracks.hensen.io
#     secretName: owntracks-tls-secret
#   rules:
#   - host: owntracks.hensen.io
#     http:
#       paths:
#       - path: /
#         pathType: Prefix
#         backend:
#           service:
#             name: otrecorder
#             port:
#               number: 8083
---
# Corrected MQTT Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mqtt-ingress
  annotations:
    cert-manager.io/cluster-issuer: prod-cluster-issuer
    # Add NGINX TCP passthrough annotations
    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
    nginx.ingress.kubernetes.io/backend-protocol: "TCP"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - mqtt.hensen.io
    secretName: mqtt-tls-secret
  rules:
  - host: mqtt.hensen.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: mqtt
            port:
              number: 8083

# Note: For proper MQTT over TLS, consider these alternatives:
# 1. Use a TCP Load Balancer instead of an Ingress
# 2. Configure the MQTT broker to use TLS directly (port 8883)
# 3. Use NGINX TCP ingress controller configuration