apiVersion: batch/v1
kind: Job
metadata:
  name: loomio-db-init
spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: db-init
        image: loomio/loomio:latest
        command:
        - /bin/bash
        - -c
        - |
          set -e
          echo "Initializing Loomio database..."
          DISABLE_DATABASE_ENVIRONMENT_CHECK=1 bundle exec rake db:migrate db:seed
          echo "Database initialization complete"
        env:
        - name: RAILS_ENV
          value: production
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: loomio-secrets
              key: dbUrl
        - name: REDIS_URL
          value: {{ .redisUrl }}
        - name: DEVISE_SECRET
          valueFrom:
            secretKeyRef:
              name: loomio-secrets
              key: deviseSecret
        - name: SECRET_COOKIE_TOKEN
          valueFrom:
            secretKeyRef:
              name: loomio-secrets
              key: secretCookieToken
      initContainers:
      - name: create-db
        image: postgres:17-alpine
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
          runAsGroup: 999
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: true
          seccompProfile:
            type: RuntimeDefault
        env:
        - name: PGHOST
          value: "{{ .db.host }}"
        - name: PGPORT
          value: "{{ .db.port }}"
        - name: PGUSER
          value: postgres
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              name: loomio-secrets
              key: postgres.password
        - name: APP_DB_NAME
          value: "{{ .db.name }}"
        - name: APP_DB_USER
          value: "{{ .db.user }}"
        - name: APP_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: loomio-secrets
              key: dbPassword
        command:
        - sh
        - -c
        - |
          set -e
          echo "Waiting for PostgreSQL to be ready..."
          until pg_isready -h $PGHOST -p $PGPORT -U $PGUSER; do
            sleep 2
          done
          psql -v ON_ERROR_STOP=1 <<-EOSQL
            DO \$\$ BEGIN
              IF NOT EXISTS (SELECT FROM pg_user WHERE usename = '$APP_DB_USER') THEN
                CREATE USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
              ELSE
                ALTER USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
              END IF;
            END \$\$;
            SELECT 'CREATE DATABASE $APP_DB_NAME OWNER $APP_DB_USER'
            WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$APP_DB_NAME')\gexec
            GRANT ALL PRIVILEGES ON DATABASE $APP_DB_NAME TO $APP_DB_USER;
          EOSQL
          psql -d "$APP_DB_NAME" -v ON_ERROR_STOP=1 <<-EOSQL
            GRANT ALL ON SCHEMA public TO $APP_DB_USER;
            CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
            CREATE EXTENSION IF NOT EXISTS hstore;
            CREATE EXTENSION IF NOT EXISTS pgcrypto;
          EOSQL
          echo "Database and user created"
        securityContext:
          runAsNonRoot: false
          runAsUser: 0
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: false
          seccompProfile:
            type: RuntimeDefault
      securityContext:
        runAsNonRoot: false
        runAsUser: 0
        seccompProfile:
          type: RuntimeDefault