{% from "macros/keys.sh" import gen_keys %}
{% set tpl = ix_lib.base.render.Render(values) %}

{% set users = namespace(x=[]) %}
{% set admin_users = namespace(x=[]) %}
{% for user in values.concourse.users %}
  {% if user.is_admin %}{% do admin_users.x.append(user.username) %}{% endif %}
  {% do users.x.append("%s:%s" | format(user.username, tpl.funcs.bcrypt_hash(user.password))) %}
{% endfor %}

{% set perm_container = tpl.deps.perms(values.consts.perms_container_name) %}
{% set web = tpl.add_container(values.consts.concourse_web_container_name, "image") %}
{% set worker = tpl.add_container(values.consts.concourse_worker_container_name, "image") %}
{% set keys = tpl.add_container(values.consts.concourse_keys_container_name, "image") %}

{% set pg_config = {
  "user": values.consts.db_user,
  "password": values.concourse.db_password,
  "database": values.consts.db_name,
  "volume": values.storage.postgres_data,
} %}
{% set postgres = tpl.deps.postgres(
  values.consts.postgres_container_name,
  values.concourse.postgres_image_selector,
  pg_config, perm_container
) %}

{# Keys #}
{% do keys.healthcheck.disable() %}
{% do keys.restart.set_policy("on-failure", 1) %}
{% do keys.deploy.resources.set_profile("low") %}
{% do keys.configs.add("config.sh", gen_keys(values), "/config.sh", "0755") %}
{% do keys.set_entrypoint(["/config.sh"]) %}
{% do keys.add_storage(values.consts.keys_path, values.storage.keystore) %}

{# Worker #}
{% do worker.set_cgroup("host") %}
{% do worker.set_privileged(true) %}
{% do worker.set_command(["worker"]) %}
{% do worker.depends.add_dependency(values.consts.concourse_web_container_name, "service_healthy") %}
{% do worker.healthcheck.set_test("http", {"port": values.consts.worker_healthcheck_port}) %}

{% do worker.environment.add_env("CONCOURSE_BIND_PORT", values.consts.worker_port) %}
{% do worker.environment.add_env("CONCOURSE_HEALTHCHECK_BIND_PORT", values.consts.worker_healthcheck_port) %}
{% do worker.environment.add_env("CONCOURSE_RUNTIME", "containerd") %}
{% do worker.environment.add_env("CONCOURSE_WORK_DIR", values.concourse.worker_workspace) %}
{% do worker.environment.add_env("CONCOURSE_TSA_HOST", "%s:%d" | format(values.consts.concourse_web_container_name, values.consts.web_tsa_bind_port)) %}
{% do worker.environment.add_env("CONCOURSE_TSA_PUBLIC_KEY", values.consts.tsa_public_key_path) %}
{% do worker.environment.add_env("CONCOURSE_TSA_WORKER_PRIVATE_KEY", values.consts.tsa_worker_private_key_path) %}
{% do worker.environment.add_user_envs(values.concourse.worker_additional_envs) %}

{% do worker.add_storage(values.consts.worker_workspace, values.storage.workspace) %}
{% do worker.add_storage(values.consts.keys_path, values.storage.keystore) %}

{# Web #}
{% do web.set_command(["web"]) %}
{% do web.depends.add_dependency(values.consts.postgres_container_name, "service_healthy") %}
{% do web.depends.add_dependency(values.consts.concourse_keys_container_name, "service_completed_successfully") %}
{% do web.healthcheck.set_test("http", {"port": values.network.http_port.port_number, "path": "/api/v1/info"}) %}

{% if values.network.certificate_id %}
  {% set cert = values.ix_certificates[values.network.certificate_id] %}
  {% do web.configs.add("private", cert.privatekey, values.consts.ssl_key_path) %}
  {% do web.configs.add("public", cert.certificate, values.consts.ssl_cert_path) %}

  {% do web.environment.add_env("CONCOURSE_TLS_CERT", values.consts.ssl_cert_path) %}
  {% do web.environment.add_env("CONCOURSE_TLS_KEY", values.consts.ssl_key_path) %}

  {% do web.environment.add_env("CONCOURSE_TLS_BIND_PORT", values.network.https_port.port_number) %}
  {% do web.add_port(values.network.https_port) %}
  {% do tpl.portals.add(values.network.https_port, {"name": "HTTPS", "scheme": "https"}) %}
{% endif %}

{% do web.environment.add_env("CONCOURSE_BIND_PORT", values.network.http_port.port_number) %}
{% do web.environment.add_env("CONCOURSE_ADD_LOCAL_USER", users.x|join(",")) %}
{% do web.environment.add_env("CONCOURSE_MAIN_TEAM_LOCAL_USER", admin_users.x|join(",")) %}
{% do web.environment.add_env("CONCOURSE_EXTERNAL_URL", values.concourse.external_url) %}
{% do web.environment.add_env("CONCOURSE_TSA_BIND_PORT",  values.consts.web_tsa_bind_port) %}
{% do web.environment.add_env("CONCOURSE_SESSION_SIGNING_KEY", values.consts.session_signing_key_path) %}
{% do web.environment.add_env("CONCOURSE_TSA_HOST_KEY", values.consts.tsa_host_key_path) %}
{% do web.environment.add_env("CONCOURSE_TSA_AUTHORIZED_KEYS", values.consts.tsa_authorized_keys_path) %}
{% do web.environment.add_env("CONCOURSE_POSTGRES_HOST", values.consts.postgres_container_name) %}
{% do web.environment.add_env("CONCOURSE_POSTGRES_PORT", 5432) %}
{% do web.environment.add_env("CONCOURSE_POSTGRES_USER", values.consts.db_user) %}
{% do web.environment.add_env("CONCOURSE_POSTGRES_DATABASE", values.consts.db_name) %}
{% do web.environment.add_env("CONCOURSE_POSTGRES_PASSWORD", values.concourse.db_password) %}
{% do web.environment.add_user_envs(values.concourse.web_additional_envs) %}

{% do web.add_port(values.network.http_port) %}
{% do web.add_storage(values.consts.keys_path, values.storage.keystore) %}

{% for store in values.storage.additional_storage %}
  {% do worker.add_storage(store.mount_path, store) %}
{% endfor %}

{% if perm_container.has_actions() %}
  {% do perm_container.activate() %}
  {% do postgres.add_dependency(values.consts.perms_container_name, "service_completed_successfully") %}
{% endif %}

{% do tpl.portals.add(values.network.http_port, {"name": "HTTP"}) %}

{{ tpl.render() | tojson }}