#SPDX-License-Identifier: MIT-0
---
# tasks file for ansible-role-peertube
- name: add peertube repo
  kubernetes.core.helm_repository:
    name: ananace-charts
    repo_url: https://ananace.gitlab.io/charts
  register: repo_update

- name: update repos
  command: helm repo update
  when: repo_update.changed

- name: deploy peertube
  kubernetes.core.helm:
    name: peertube
    chart_ref: ananace-charts/peertube
    release_namespace: peertube
    create_namespace: true
    values:
      image:
        repository: chocobozzz/peertube
        pullPolicy: IfNotPresent
      config:
        serverName: peertube.eom.dev
        webadminConfig: true
        secret: "{{ peertube_secret }}"
        admin:
          email: eric@eom.dev
        mail:
          transport: smtp
          # sendmail:
          hostname: postfix.eom.dev
          port: 587
          username: peertube
          fromAddress: peertube@eom.dev
          password: "{{ peertube_admin_password }}"
        ## Data storage on S3 - will still require persistence even if enabled.
        objectStorage:
          enabled: false
          endpoint: minio.eom.dev
          region: us-east-1
          # uploadACL: public-read
          # uploadACLPrivate: private
          # maxUploadPart: 2GB
          accessKey: "{{ peertube_minio_access_key }}"
          secretKey: "{{ peertube_minio_secret_key }}"

          streaming:
            bucket_name: peertube
            prefix: streaming/
            # base_url:

          videos:
            bucket_name: peertube
            prefix: videos/
            # base_url:

          exports:
            bucket_name: peertube
            prefix: exports/
            # base_url:

          originals:
            bucket_name: peertube
            prefix: originals/
            # base_url:

          captions:
            bucket_name: peertube
            prefix: captions/
            # base_url:

        ## Main persistent storage, will be used for uploads, processing, plugins, etc
        persistence:
          enabled: true

          size: 2Ti
          storageClass: "nfs-client"
      extraConfig:
        ## It's recommended to limit this to only your internal cluster network
        trust_proxy:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.1.0/24
          - fc00::/7
          # - loopback

        instance:
          description: "PeerTube on eom.dev"
          customizations:
            # Adds "Sign up" -> www.eom.dev/members next to Log in.
            javascript: "{{ lookup('ansible.builtin.file', role_path ~ '/files/signup.js') }}"

        # Log in goes straight to Dex (oidc-cnr is the only external auth).
        # Admin password login: /login?externalRedirect=false
        client:
          menu:
            login:
              redirect_on_single_external_auth: true

      ## Extra environment variables to set on Peertube
      ##
      extraEnv:
        - name: PT_INITIAL_ROOT_PASSWORD
          value: "{{ peertube_admin_password }}"
        - name: AWS_ACCESS_KEY_ID
          value: "{{ peertube_minio_access_key }}"
        - name: AWS_SECRET_ACCESS_KEY
          value: "{{ peertube_minio_secret_key }}"
        # - name: TZ
        #   value: Europe/Stockholm
      extraSecret: {}
        # PEERTUBE_INSTANCE_TERMS: "These are some very secret terms-of-service"

      ## Extra values to set on the pod spec.
      ## Can be used for setting things like host aliases, overhead, custom schedulers, etc
      ##
      extraPodSpec: {}

      # Additional volumes of the peertube pod.
      extraVolumes: []
        # - name: my-config
        #   configMap:
        #     name: my-config

      # Additional volume mounts of the peertube container.
      extraVolumeMounts: []
        # - name: my-config
        #   mountPath: /my-path/
        #   subPath: my-file

      ## Self-deployed PostgreSQL database
      ## See: https://github.com/bitnami/charts/tree/master/bitnami/postgresql
      ##
      postgresql:
        enabled: true
        ssl: false
        image:
          repository: bitnamilegacy/postgresql

        auth:
          database: peertube
          username: peertube
          password: "{{ peertube_postgresql_password }}"

          # existingSecret:
          # secretKeys:
          #   userPasswordKey: password

        persistence:
          enabled: true

      ## Externally managed PostgreSQL, required if postgresql.enabled=false
      ##
      externalPostgresql:
        host:
        # port: 5432

        database: peertube
        username: peertube
        # password:
        ssl: false

        # existingSecret:
        # existingSecretKey: postgres-password

      ## Self-deployed Redis database
      ## See: https://github.com/bitnami/charts/tree/master/bitnami/redis
      ##
      redis:
        enabled: true
        architecture: standalone
        image:
          repository: bitnamilegacy/redis


        auth:
          enabled: true
          # password: peertube

          # existingSecret: redis-secret
          # existingSecretPasswordKey: redis-password

        master:
          kind: Deployment
          persistence:
            enabled: true

      ## Externally managed Redis, required if redis.enabled=false
      ##
      externalRedis:
        host:
        # port: 6379
        # db: 0

        # password:

        # existingSecret:
        # existingSecretKey: redis-password

      ## Default probes, using ping API to avoid excessive echo
      ##
      # Small nodes: cold start (plugins, migrations) can take minutes, and the
      # ping can stall briefly under load. Allow up to 10 minutes to start.
      livenessProbe:
        httpGet:
          path: /api/v1/ping
          port: http
        timeoutSeconds: 5
        failureThreshold: 6
      readinessProbe:
        httpGet:
          path: /api/v1/ping
          port: http
        timeoutSeconds: 5
      startupProbe:
        httpGet:
          path: /api/v1/ping
          port: http
        timeoutSeconds: 5
        periodSeconds: 10
        failureThreshold: 60

      serviceAccount:
        ## Specifies whether a service account should be created
        create: true
        ## Annotations to add to the service account
        annotations: {}
        ## The name of the service account to use.
        ## If not set and create is true, a name is generated using the fullname template
        # name:

      podAnnotations: {}

      podSecurityContext:
        fsGroup: 999

      securityContext:
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 999
        # capabilities:
        #   drop:
        #   - ALL

      service:
        type: ClusterIP
        port: 80
        rtmpPort: 1935

      ingress:
        enabled: true
        className: "nginx"
        annotations:
          cert-manager.io/cluster-issuer: ca-issuer
          nginx.ingress.kubernetes.io/proxy-set-header: "X-Forwarded-For"
          nginx.ingress.kubernetes.io/proxy-body-size: 4G
        paths:
          - path: /
            pathType: ImplementationSpecific
        tls:
         - secretName: peertube-tls
           hosts:
             - peertube.eom.dev

      resources: {}
        # limits:
        #   cpu: 100m
        #   memory: 128Mi
        # requests:
        #   cpu: 100m
        #   memory: 128Mi

      autoscaling:
        enabled: false
        minReplicas: 1
        maxReplicas: 3
        targetCPUUtilizationPercentage: 80
        # targetMemoryUtilizationPercentage: 80

      nodeSelector: {}

      tolerations: []

      # Keep heavy apps off the 1-CPU node that hosts ingress-nginx; sharing it
      # starved Nextcloud and risks the ingress / MetalLB announcement.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname
              namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: ingress-nginx
              labelSelector:
                matchLabels:
                  app.kubernetes.io/component: controller
                  app.kubernetes.io/name: ingress-nginx

# oidc-cnr settings live in PeerTube's database; set the claims Dex sends.
- name: Find the PeerTube pod
  kubernetes.core.k8s_info:
    kind: Pod
    namespace: peertube
    label_selectors:
      - app.kubernetes.io/name=peertube
    field_selectors:
      - status.phase=Running
  register: peertube_pods

- name: Configure the oidc-cnr plugin for Dex
  kubernetes.core.k8s_exec:
    namespace: peertube
    pod: "{{ peertube_pods.resources[0].metadata.name }}"
    container: peertube
    command: >-
      node -e '
      const {Client}=require("pg");
      const c=new Client({host:process.env.PEERTUBE_DB_HOSTNAME||"peertube-postgresql",user:process.env.PEERTUBE_DB_USERNAME||"peertube",password:process.env.PEERTUBE_DB_PASSWORD,database:"peertube"+(process.env.PEERTUBE_DB_SUFFIX||"")});
      (async()=>{await c.connect();
      const r=await c.query("select settings from plugin where name=$1",["oidc-cnr"]);
      if(!r.rows.length){console.log("oidc-cnr not installed");return c.end();}
      const s=Object.assign(r.rows[0].settings||{},{"discover-url":"https://dex.eom.dev/.well-known/openid-configuration","client-id":"peertube","client-secret":process.argv[1],"scope":"openid email profile groups","group-property":"groups","allowed-group":"PeerTube Users","username-property":"preferred_username","display-name-property":"name","mail-property":"email","auth-display-name":"eom.dev account"});
      await c.query("update plugin set settings=$1 where name=$2",[JSON.stringify(s),"oidc-cnr"]);await c.end();})().catch(e=>{console.error(e.message);process.exit(1)})'
      {{ peertube_dex_client_secret | quote }}
  changed_when: false
  no_log: true