---
# PersistentVolumeClaim for OwnTracks Recorder
# apiVersion: v1
# kind: PersistentVolumeClaim
# metadata:
#   name: otrecorder-config-pvc
# spec:
#   accessModes:
#     - ReadWriteOnce
#   resources:
#     requests:
#       storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: otrecorder-store-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
---
# PersistentVolumeClaim for Mosquitto
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mosquitto-data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mosquitto-logs-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
# ExternalSecret for OwnTracks Recorder password
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: owntracks-mqtt-credentials
spec:
  refreshInterval: "15m"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: owntracks-mqtt-password
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: kv/mqtt
        property: password

---
# Deployment for OwnTracks Recorder
apiVersion: apps/v1
kind: Deployment
metadata:
  name: otrecorder
spec:
  replicas: 1
  selector:
    matchLabels:
      app: otrecorder
  template:
    metadata:
      labels:
        app: otrecorder
    spec:
      containers:
      - name: otrecorder
        image: owntracks/recorder
        ports:
        - containerPort: 8083
        env:
        - name: OTR_HOST
          value: "mqtt"
        - name: OTR_PORT
          value: "1883"
        - name: OTR_USER
          value: "ruben"
        - name: OTR_CLIENTID
          value: ""
        - name: OTR_PASS
          valueFrom:
            secretKeyRef:
              name: owntracks-mqtt-password
              key: password
        volumeMounts:
        - name: store
          mountPath: /store
      volumes:
      - name: store
        persistentVolumeClaim:
          claimName: otrecorder-store-pvc
---
# Service for OwnTracks Recorder
apiVersion: v1
kind: Service
metadata:
  name: otrecorder
spec:
  selector:
    app: otrecorder
  ports:
  - port: 8083
    targetPort: 8083
  type: ClusterIP
---
# ExternalSecret to fetch MQTT password file from Vault
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: mqtt-password-file
spec:
  refreshInterval: "15m"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: mqtt-password-secret
    creationPolicy: Owner
  data:
    - secretKey: password_file
      remoteRef:
        key: kv/mqtt
        property: secret

---
# ConfigMap for MQTT configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: mqtt-config
data:
  mosquitto.conf: |
    listener 1883
    allow_anonymous false
    password_file /mosquitto/config/password_file
    # Add other MQTT configuration options here
    protocol websockets
---
# MQTT Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mqtt
  labels:
    app: mqtt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mqtt
  template:
    metadata:
      labels:
        app: mqtt
    spec:
      containers:
      - name: mqtt
        image: eclipse-mosquitto:latest
        ports:
        - containerPort: 1883
          name: mqtt
        - containerPort: 9001
          name: websocket
        volumeMounts:
        - name: config
          mountPath: /mosquitto/config/mosquitto.conf
          subPath: mosquitto.conf
        - name: password-file
          mountPath: /mosquitto/config/password_file
          subPath: password_file
      volumes:
      - name: config
        configMap:
          name: mqtt-config
      - name: password-file
        secret:
          secretName: mqtt-password-secret

---
# MQTT Service
apiVersion: v1
kind: Service
metadata:
  name: mqtt
spec:
  selector:
    app: mqtt
  ports:
  - port: 1883
    targetPort: 1883
    name: mqtt
  - port: 9001
    targetPort: 9001
    name: websocket
---
# External access with Ingress for OwnTracks Recorder
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: otrecorder-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: prod-cluster-issuer
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - owntracks.hensen.io
    secretName: owntracks-tls-secret
  rules:
  - host: owntracks.hensen.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: otrecorder
            port:
              number: 8083
---
# Corrected MQTT Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mqtt-ingress
  annotations:
    cert-manager.io/cluster-issuer: prod-cluster-issuer
    # Add NGINX TCP passthrough annotations
    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
    nginx.ingress.kubernetes.io/backend-protocol: "TCP"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - mqtt.hensen.io
    secretName: mqtt-tls-secret
  rules:
  - host: mqtt.hensen.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: mqtt
            port:
              number: 1883

# Note: For proper MQTT over TLS, consider these alternatives:
# 1. Use a TCP Load Balancer instead of an Ingress
# 2. Configure the MQTT broker to use TLS directly (port 8883)
# 3. Use NGINX TCP ingress controller configuration