apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: davical
  namespace: pim
spec:
  interval: 10m
  dependsOn:
    - name: davical-postgres
  chartRef:
    kind: OCIRepository
    name: davical
  driftDetection:
    mode: enabled
  values:
    controllers:
      app:
        initContainers:
          seed-config:
            image:
              repository: tuxnvape/davical-standalone
              tag: "82-1.1.12"
            command:
              - sh
              - -c
              - |
                if [ ! -f /mnt/config-pvc/davical.php ]; then
                  cp -r /config/. /mnt/config-pvc/
                fi
                # Apache's SCRIPT_NAME (and DAViCal's base_url derived from it)
                # only reflects the /server prefix if Apache itself resolves
                # that prefix - Traefik forwards the path unstripped. Add an
                # Alias so /server/* maps to the app root; idempotent so it
                # self-heals if apache.conf predates this fix.
                if ! grep -q '^\s*Alias /server ' /mnt/config-pvc/apache.conf; then
                  sed -i '/^\s*DocumentRoot \/usr\/share\/davical\/htdocs/a\        Alias /server /usr/share/davical/htdocs' /mnt/config-pvc/apache.conf
                fi
        containers:
          app:
            image:
              repository: tuxnvape/davical-standalone
              tag: "82-1.1.12"
            env:
              TZ: Europe/Moscow
              HOST_NAME: c.aggtaa.com
              DBHOST: davical-postgres
              UPDATE_FROM_OLD: "false"
              PGSQL_ROOT_PASS:
                valueFrom:
                  secretKeyRef:
                    name: davical-secrets
                    key: PGSQL_ROOT_PASS
              PASSDAVDB:
                valueFrom:
                  secretKeyRef:
                    name: davical-secrets
                    key: PASSDAVDB
              ADMINDAVICALPASS:
                valueFrom:
                  secretKeyRef:
                    name: davical-secrets
                    key: ADMINDAVICALPASS
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true
              startup:
                enabled: true
                spec:
                  periodSeconds: 5
                  failureThreshold: 30
                  timeoutSeconds: 3

    service:
      app:
        controller: app
        ports:
          http:
            port: 80

    ingress:
      app:
        className: traefik
        # no cert-manager annotation here: radicale's own Ingress already
        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
        # A second Ingress with the annotation would create a competing
        # Certificate for the same host/secret.
        #
        # No stripPrefix middleware either: Apache needs to see the /server
        # prefix itself (via the Alias added in the seed-config initContainer)
        # so that DAViCal's self-referential links come out correct.
        hosts:
          - host: c.aggtaa.com
            paths:
              - path: /server
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: radicale-tls
            hosts:
              - c.aggtaa.com

    persistence:
      config:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
        size: 256Mi
        storageClass: longhorn
        retain: true
        advancedMounts:
          app:
            app:
              - path: /config
            seed-config:
              - path: /mnt/config-pvc