apiVersion: v1
kind: ConfigMap
metadata:
  name: mas-config-tmpl
  namespace: matrix
data:
  config.yaml: |
    http:
      listeners:
        - name: web
          resources:
            - name: discovery
            - name: human
            - name: oauth
            - name: compat
            - name: graphql
            - name: assets
            - name: adminapi
          binds:
            - host: "::"
              port: 8080
      public_base: "https://mas.mynest.love/"
      
    database:
      uri: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres-svc:5432/mas"
      
    matrix:
      homeserver: "starling.mynest.love"
      endpoint: "http://synapse-svc:8008"
      secret: "${MAS_SYNAPSE_CLIENT_SECRET}"

    upstream_oauth2:
      providers:
        - id: 01J1ABCD2345EFGH6789JKMNPQ
          issuer: "https://sso.mynest.love/realms/nest"
          client_id: "${CLIENT_ID}"
          client_secret: "${CLIENT_SECRET}"
          token_endpoint_auth_method: "client_secret_basic"
          scope: "openid profile email"
          claims_imports:
            subject:
              template: "{{ user.sub }}"
            localpart:
              action: "ignore"
            displayname:
              action: "suggest"
              template: "{{ user.name }}"
            email:
              action: "suggest"
              template: "{{ user.email }}"
              set_email_verification: "always"

    secrets:
      encryption: "${MAS_ENCRYPTION_SECRET}"
      keys:
        - key_file: "/secrets/MAS_RSA_KEY"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mas
  namespace: matrix
  annotations:
    keel.sh/policy: "all"
    keel.sh/match-tag: "true"
    keel.sh/schedule: "0 3 * * *"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mas
  template:
    metadata:
      labels:
        app: mas
    spec:
      initContainers:
        - name: generate-config
          image: alpine:latest
          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/config.yaml > /data/config.yaml"]
          envFrom:
            - secretRef:
                name: matrix-secrets
          volumeMounts:
            - name: config-tmpl
              mountPath: /tmpl/config.yaml
              subPath: config.yaml
            - name: mas-data
              mountPath: /data
      containers:
        - name: mas
          image: ghcr.io/element-hq/matrix-authentication-service:latest
          env:
            - name: MAS_CONFIG
              value: "/data/config.yaml"
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: mas-data
              mountPath: /data
            - name: secrets-volume
              mountPath: /secrets
              readOnly: true
      volumes:
        - name: mas-data
          emptyDir: {}
        - name: config-tmpl
          configMap:
            name: mas-config-tmpl
        - name: secrets-volume
          secret:
            secretName: matrix-secrets