Cloud: EKS Infrastructure and Helm Deployment

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.70"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.7"
    }
  }

  # Partial configuration: the bucket is passed with -backend-config.
  backend "s3" {
    key                  = "magento/pocketcoffee.tfstate"
    workspace_key_prefix = "workspaces"
    region               = "eu-west-1"
    encrypt              = true
    use_lockfile         = true
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Project     = "pocketcoffee-magento"
      Environment = local.env
      ManagedBy   = "opentofu"
    }
  }
}

# CloudFront certificates must be requested in us-east-1.
provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"

  default_tags {
    tags = {
      Project     = "pocketcoffee-magento"
      Environment = local.env
      ManagedBy   = "opentofu"
    }
  }
}

variable "region" {
  description = "Region of the cluster and of every regional resource."
  type        = string
  default     = "eu-west-1"
}

variable "root_domain" {
  description = "Public Route 53 hosted zone that already exists."
  type        = string
  default     = "pocketcoffee.example"
}

variable "admin_cidrs" {
  description = "CIDR blocks allowed to reach the public Kubernetes API endpoint and the Magento Admin."
  type        = list(string)
  default     = ["203.0.113.0/24"]
}

variable "github_repository" {
  description = "Repository whose workflows may push images to ECR and deploy (OIDC subject)."
  type        = string
  default     = "pocketcoffee/magento-shop"
}

variable "admin_front_name" {
  description = "Admin frontName (env MAGENTO_BACKEND_FRONTNAME), used by the WAF rule that restricts it."
  type        = string
  default     = "admin_pocketcoffee"
}

variable "media_mode" {
  description = "Where pub/media lives: s3 (remote storage) or efs. The bucket always exists; the file system only for efs."
  type        = string
  default     = "s3"

  validation {
    condition     = contains(["s3", "efs"], var.media_mode)
    error_message = "media_mode must be s3 or efs."
  }
}

data "aws_caller_identity" "current" {}
data "aws_availability_zones" "available" {
  state = "available"
}

locals {
  # One workspace per environment; "default" is deliberately not a key.
  environments = {
    staging = {
      env                  = "staging"
      site_host            = "staging.pocketcoffee.example"
      media_host           = "media-staging.pocketcoffee.example"
      vpc_cidr             = "10.30.0.0/16"
      single_nat           = true
      kubernetes_version   = "1.36"
      db_instance_class    = "db.t4g.large"
      db_multi_az          = false
      db_allocated_gb      = 100
      db_deletion_protect  = false
      search_instance_type = "m7g.large.search"
      search_nodes         = 3
      search_dedicated     = false
      cache_node_type      = "cache.t4g.medium"
      cache_replicas       = 1
      session_node_type    = "cache.t4g.small"
      session_replicas     = 1
      mq_instance_type     = "mq.m7g.large"
      mq_mode              = "SINGLE_INSTANCE"
    }
    production = {
      env                  = "prod"
      site_host            = "www.pocketcoffee.example"
      media_host           = "media.pocketcoffee.example"
      vpc_cidr             = "10.10.0.0/16"
      single_nat           = false
      kubernetes_version   = "1.36"
      db_instance_class    = "db.r7g.xlarge"
      db_multi_az          = true
      db_allocated_gb      = 300
      db_deletion_protect  = true
      search_instance_type = "r7g.large.search"
      search_nodes         = 3
      search_dedicated     = true
      cache_node_type      = "cache.r7g.large"
      cache_replicas       = 2
      session_node_type    = "cache.r7g.large"
      session_replicas     = 2
      mq_instance_type     = "mq.m7g.large"
      mq_mode              = "CLUSTER_MULTI_AZ"
    }
  }

  cfg  = local.environments[terraform.workspace]
  env  = local.cfg.env
  name = "pocketcoffee-${local.env}"
  azs  = slice(data.aws_availability_zones.available.names, 0, 3)

  # Secrets Manager names follow pocketcoffee/<env>/<purpose>.
  secret_prefix = "pocketcoffee/${local.env}"

  # The shop is always created with this namespace and service account.
  namespace       = "pocketcoffee"
  service_account = "pocketcoffee-magento"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "6.7.3"

  name = local.name
  cidr = local.cfg.vpc_cidr
  azs  = local.azs

  public_subnets      = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i)]
  private_subnets     = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 4, i + 1)]
  database_subnets    = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i + 100)]
  elasticache_subnets = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i + 110)]

  create_database_subnet_group    = true
  create_elasticache_subnet_group = true

  enable_nat_gateway     = true
  single_nat_gateway     = local.cfg.single_nat
  one_nat_gateway_per_az = !local.cfg.single_nat

  public_subnet_tags  = { "kubernetes.io/role/elb" = 1 }
  private_subnet_tags = { "kubernetes.io/role/internal-elb" = 1 }
}

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = module.vpc.vpc_id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = module.vpc.private_route_table_ids
}

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
  version = "4.2.2"

  description = "${local.name}: Secrets Manager, RDS, OpenSearch, ElastiCache, Amazon MQ and EFS"
  aliases     = ["pocketcoffee/${local.env}"]

  enable_key_rotation = true
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "21.29.0"

  name               = local.name
  kubernetes_version = local.cfg.kubernetes_version

  vpc_id                   = module.vpc.vpc_id
  subnet_ids               = module.vpc.private_subnets
  control_plane_subnet_ids = module.vpc.private_subnets

  endpoint_public_access       = true
  endpoint_public_access_cidrs = var.admin_cidrs
  endpoint_private_access      = true

  enable_cluster_creator_admin_permissions = true

  # The deployment role of the GitHub workflow may administer the shop's namespace and nothing else.
  access_entries = {
    github_deploy = {
      principal_arn = aws_iam_role.github_deploy.arn
      policy_associations = {
        namespace_admin = {
          policy_arn = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy"
          access_scope = {
            type       = "namespace"
            namespaces = [local.namespace]
          }
        }
      }
    }
  }

  compute_config = {
    enabled    = true
    node_pools = ["general-purpose"]
  }

  addons = {
    eks-pod-identity-agent = {
      before_compute = true
    }
    aws-efs-csi-driver = {
      pod_identity_association = [{
        role_arn        = aws_iam_role.efs_csi.arn
        service_account = "efs-csi-controller-sa"
      }]
    }
  }
}

data "aws_iam_policy_document" "pods_trust" {
  statement {
    actions = ["sts:AssumeRole", "sts:TagSession"]
    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "efs_csi" {
  name               = "${local.name}-efs-csi"
  assume_role_policy = data.aws_iam_policy_document.pods_trust.json
}

resource "aws_iam_role_policy_attachment" "efs_csi" {
  role       = aws_iam_role.efs_csi.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
}

# External Secrets Operator: read only the secrets of this environment.
data "aws_iam_policy_document" "external_secrets" {
  statement {
    actions   = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
    resources = ["arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${local.secret_prefix}/*"]
  }
  statement {
    actions   = ["kms:Decrypt"]
    resources = [module.kms.key_arn]
  }
}

resource "aws_iam_role" "external_secrets" {
  name               = "${local.name}-external-secrets"
  assume_role_policy = data.aws_iam_policy_document.pods_trust.json
}

resource "aws_iam_role_policy" "external_secrets" {
  role   = aws_iam_role.external_secrets.id
  policy = data.aws_iam_policy_document.external_secrets.json
}

resource "aws_eks_pod_identity_association" "external_secrets" {
  cluster_name    = module.eks.cluster_name
  namespace       = "external-secrets"
  service_account = "external-secrets"
  role_arn        = aws_iam_role.external_secrets.arn
}

resource "aws_security_group" "db" {
  name_prefix = "${local.name}-db-"
  description = "MySQL from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "db_from_cluster" {
  security_group_id            = aws_security_group.db.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 3306
  to_port                      = 3306
  ip_protocol                  = "tcp"
  description                  = "MySQL from pods on EKS nodes"
}

module "db" {
  source  = "terraform-aws-modules/rds/aws"
  version = "7.2.2"

  identifier = local.name

  engine               = "mysql"
  engine_version       = "8.4"
  family               = "mysql8.4"
  major_engine_version = "8.4"
  instance_class       = local.cfg.db_instance_class

  allocated_storage     = local.cfg.db_allocated_gb
  max_allocated_storage = local.cfg.db_allocated_gb * 4
  storage_type          = "gp3"
  storage_encrypted     = true
  kms_key_id            = module.kms.key_arn

  db_name  = "pocketcoffee"
  username = "mg_admin"
  port     = 3306

  # RDS creates and rotates the master password in Secrets Manager. The users
  # mg_app and mg_migrate are created by the bootstrap step (see the text).
  manage_master_user_password   = true
  master_user_secret_kms_key_id = module.kms.key_arn

  multi_az               = local.cfg.db_multi_az
  db_subnet_group_name   = module.vpc.database_subnet_group_name
  vpc_security_group_ids = [aws_security_group.db.id]
  publicly_accessible    = false

  backup_retention_period = 14
  backup_window           = "02:00-03:00"
  maintenance_window      = "Mon:03:30-Mon:04:30"
  copy_tags_to_snapshot   = true
  deletion_protection     = local.cfg.db_deletion_protect
  skip_final_snapshot     = !local.cfg.db_deletion_protect

  auto_minor_version_upgrade      = true
  enabled_cloudwatch_logs_exports = ["error", "slowquery"]

  parameter_group_name            = "pocketcoffee-magento-mysql84"
  parameter_group_use_name_prefix = false
  parameter_group_description     = "Magento 2.4.9 on MySQL 8.4"

  parameters = [
    { name = "character_set_server", value = "utf8mb4" },
    { name = "collation_server", value = "utf8mb4_general_ci" },
    # Magento creates triggers (mview) and, with automated backups, binary logging is on.
    { name = "log_bin_trust_function_creators", value = "1" },
    { name = "max_allowed_packet", value = "134217728" },
    { name = "slow_query_log", value = "1" },
    { name = "long_query_time", value = "1" },
    { name = "max_connections", value = "800", apply_method = "pending-reboot" },
  ]
}

resource "aws_security_group" "search" {
  name_prefix = "${local.name}-search-"
  description = "OpenSearch HTTPS from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "search_from_cluster" {
  security_group_id            = aws_security_group.search.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 443
  to_port                      = 443
  ip_protocol                  = "tcp"
  description                  = "OpenSearch from pods on EKS nodes"
}

# The password is embedded in a URL by Magento, so it uses only URL-safe characters.
resource "random_password" "search" {
  length           = 32
  special          = true
  override_special = "-_."
  min_upper        = 2
  min_lower        = 2
  min_numeric      = 2
  min_special      = 1
}

resource "aws_opensearch_domain" "main" {
  domain_name    = local.name
  engine_version = "OpenSearch_3.5"

  cluster_config {
    instance_type            = local.cfg.search_instance_type
    instance_count           = local.cfg.search_nodes
    zone_awareness_enabled   = true
    dedicated_master_enabled = local.cfg.search_dedicated
    dedicated_master_type    = local.cfg.search_dedicated ? "m7g.large.search" : null
    dedicated_master_count   = local.cfg.search_dedicated ? 3 : null

    zone_awareness_config {
      availability_zone_count = 3
    }
  }

  ebs_options {
    ebs_enabled = true
    volume_type = "gp3"
    volume_size = 200
  }

  vpc_options {
    subnet_ids         = module.vpc.private_subnets
    security_group_ids = [aws_security_group.search.id]
  }

  encrypt_at_rest {
    enabled    = true
    kms_key_id = module.kms.key_arn
  }

  node_to_node_encryption {
    enabled = true
  }

  domain_endpoint_options {
    enforce_https       = true
    tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
  }

  advanced_security_options {
    enabled                        = true
    internal_user_database_enabled = true
    master_user_options {
      master_user_name     = "magento"
      master_user_password = random_password.search.result
    }
  }

  # Fine-grained access control does the authorisation; the resource policy only opens the domain to the VPC.
  access_policies = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "*" }
      Action    = "es:ESHttp*"
      Resource  = "arn:aws:es:${var.region}:${data.aws_caller_identity.current.account_id}:domain/${local.name}/*"
    }]
  })

  auto_tune_options {
    desired_state = "ENABLED"
  }
}

resource "aws_security_group" "cache" {
  name_prefix = "${local.name}-cache-"
  description = "Valkey from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "valkey_from_cluster" {
  security_group_id            = aws_security_group.cache.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 6379
  to_port                      = 6379
  ip_protocol                  = "tcp"
  description                  = "Valkey (TLS) from pods on EKS nodes"
}

# AUTH tokens: 16 to 128 printable characters, no @, " or /. They land in the (encrypted) state.
resource "random_password" "valkey" {
  for_each = toset(["cache", "session"])

  length  = 48
  special = false
}

# The Magento cache: rebuildable, so no snapshots; entries expire, tag sets do not, hence volatile-lru.
resource "aws_elasticache_parameter_group" "cache" {
  name        = "${local.name}-cache-valkey9"
  family      = "valkey9"
  description = "Magento cache"

  parameter {
    name  = "maxmemory-policy"
    value = "volatile-lru"
  }
}

# Sessions: never evicted; a full instance refuses writes instead of logging customers out.
resource "aws_elasticache_parameter_group" "session" {
  name        = "${local.name}-session-valkey9"
  family      = "valkey9"
  description = "Magento sessions"

  parameter {
    name  = "maxmemory-policy"
    value = "noeviction"
  }
}

resource "aws_elasticache_replication_group" "cache" {
  replication_group_id = "${local.name}-cache"
  description          = "Magento cache for ${local.name}"

  engine         = "valkey"
  engine_version = "9.0"
  node_type      = local.cfg.cache_node_type
  port           = 6379

  num_cache_clusters         = local.cfg.cache_replicas + 1
  automatic_failover_enabled = true
  multi_az_enabled           = true

  subnet_group_name    = module.vpc.elasticache_subnet_group_name
  security_group_ids   = [aws_security_group.cache.id]
  parameter_group_name = aws_elasticache_parameter_group.cache.name

  at_rest_encryption_enabled = true
  kms_key_id                 = module.kms.key_arn
  transit_encryption_enabled = true
  auth_token                 = random_password.valkey["cache"].result

  snapshot_retention_limit = 0
}

resource "aws_elasticache_replication_group" "session" {
  replication_group_id = "${local.name}-session"
  description          = "Magento sessions for ${local.name}"

  engine         = "valkey"
  engine_version = "9.0"
  node_type      = local.cfg.session_node_type
  port           = 6379

  num_cache_clusters         = local.cfg.session_replicas + 1
  automatic_failover_enabled = true
  multi_az_enabled           = true

  subnet_group_name    = module.vpc.elasticache_subnet_group_name
  security_group_ids   = [aws_security_group.cache.id]
  parameter_group_name = aws_elasticache_parameter_group.session.name

  at_rest_encryption_enabled = true
  kms_key_id                 = module.kms.key_arn
  transit_encryption_enabled = true
  auth_token                 = random_password.valkey["session"].result

  snapshot_retention_limit = 1
  snapshot_window          = "01:00-02:00"
}

resource "aws_security_group" "mq" {
  name_prefix = "${local.name}-mq-"
  description = "AMQP over TLS and the management API from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "mq_amqps_from_cluster" {
  security_group_id            = aws_security_group.mq.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 5671
  to_port                      = 5671
  ip_protocol                  = "tcp"
  description                  = "AMQP over TLS from pods on EKS nodes"
}

resource "aws_vpc_security_group_ingress_rule" "mq_management_from_cluster" {
  security_group_id            = aws_security_group.mq.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 443
  to_port                      = 443
  ip_protocol                  = "tcp"
  description                  = "Management API (KEDA queue length) from pods on EKS nodes"
}

# Letters and digits only: KEDA puts the password into a URL, and Amazon MQ forbids a few characters anyway.
resource "random_password" "mq" {
  length  = 32
  special = false
}

resource "aws_mq_broker" "main" {
  broker_name = "${local.name}-mq"

  engine_type        = "RabbitMQ"
  engine_version     = "4.3"
  host_instance_type = local.cfg.mq_instance_type
  deployment_mode    = local.cfg.mq_mode

  # Single instance: one subnet. Cluster: at least one; here one per zone.
  subnet_ids          = local.cfg.mq_mode == "SINGLE_INSTANCE" ? [module.vpc.private_subnets[0]] : module.vpc.private_subnets
  security_groups     = [aws_security_group.mq.id]
  publicly_accessible = false

  auto_minor_version_upgrade = true

  encryption_options {
    kms_key_id        = module.kms.key_arn
    use_aws_owned_key = false
  }

  logs {
    general = true
  }

  maintenance_window_start_time {
    day_of_week = "SUNDAY"
    time_of_day = "03:00"
    time_zone   = "UTC"
  }

  user {
    username = "magento"
    password = random_password.mq.result
  }
}

# The bucket behind remote storage (driver aws-s3) and the role of the Magento pods.
# The media page extends this file with the bucket policy, CloudFront and the DNS record.
resource "aws_s3_bucket" "media" {
  bucket = "pocketcoffee-${local.env}-media"
}

resource "aws_s3_bucket_public_access_block" "media" {
  bucket                  = aws_s3_bucket.media.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

data "aws_iam_policy_document" "magento_media" {
  statement {
    sid       = "ListBucket"
    actions   = ["s3:ListBucket", "s3:GetBucketLocation"]
    resources = [aws_s3_bucket.media.arn]
  }
  statement {
    sid = "ReadWriteObjects"
    actions = [
      "s3:GetObject", "s3:PutObject", "s3:DeleteObject",
      "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts",
    ]
    resources = ["${aws_s3_bucket.media.arn}/*"]
  }
}

resource "aws_iam_role" "magento" {
  name               = "${local.name}-magento"
  assume_role_policy = data.aws_iam_policy_document.pods_trust.json
}

resource "aws_iam_role_policy" "magento_media" {
  name   = "media-bucket"
  role   = aws_iam_role.magento.id
  policy = data.aws_iam_policy_document.magento_media.json
}

# Every workload of the chart uses this service account.
resource "aws_eks_pod_identity_association" "magento" {
  cluster_name    = module.eks.cluster_name
  namespace       = local.namespace
  service_account = local.service_account
  role_arn        = aws_iam_role.magento.arn
}

# Only for media_mode = "efs": pub/media on a shared file system instead of S3.
resource "aws_security_group" "efs" {
  count = var.media_mode == "efs" ? 1 : 0

  name_prefix = "${local.name}-efs-"
  description = "NFS from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "efs_from_cluster" {
  count = var.media_mode == "efs" ? 1 : 0

  security_group_id            = aws_security_group.efs[0].id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 2049
  to_port                      = 2049
  ip_protocol                  = "tcp"
  description                  = "NFS from pods on EKS nodes"
}

module "efs" {
  source  = "terraform-aws-modules/efs/aws"
  version = "2.2.1"

  create = var.media_mode == "efs"

  name        = "pocketcoffee-${local.env}-media"
  encrypted   = true
  kms_key_arn = module.kms.key_arn

  performance_mode = "generalPurpose"
  throughput_mode  = "elastic"

  mount_targets = {
    for i, subnet_id in module.vpc.private_subnets : "az${i}" => {
      subnet_id       = subnet_id
      security_groups = [one(aws_security_group.efs[*].id)]
    }
  }

  # pub/media lives below /media; every client is UID/GID 33 (www-data).
  access_points = {
    media = {
      name = "media"
      posix_user = {
        uid = 33
        gid = 33
      }
      root_directory = {
        path = "/media"
        creation_info = {
          owner_uid   = 33
          owner_gid   = 33
          permissions = "0775"
        }
      }
    }
  }

  enable_backup_policy = true
}

variable "github_oidc_provider_arn" {
  description = "ARN of the account's GitHub OIDC provider; empty creates it (one per account, so only one workspace does)."
  type        = string
  default     = ""
}

module "ecr" {
  source  = "terraform-aws-modules/ecr/aws"
  version = "3.2.1"

  for_each = toset(["magento", "varnish"])

  # Created in the production workspace only; staging pulls from the same repositories.
  create = terraform.workspace == "production"

  repository_name                 = "pocketcoffee/${each.key}"
  repository_image_tag_mutability = "IMMUTABLE"
  repository_image_scan_on_push   = true

  repository_lifecycle_policy = jsonencode({
    rules = [{
      rulePriority = 1
      description  = "Keep the last 60 tags"
      selection = {
        tagStatus   = "any"
        countType   = "imageCountMoreThan"
        countNumber = 60
      }
      action = { type = "expire" }
    }]
  })
}

resource "aws_iam_openid_connect_provider" "github" {
  count = var.github_oidc_provider_arn == "" ? 1 : 0

  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]
}

locals {
  github_oidc_arn = var.github_oidc_provider_arn != "" ? var.github_oidc_provider_arn : aws_iam_openid_connect_provider.github[0].arn
}

data "aws_iam_policy_document" "github_trust" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [local.github_oidc_arn]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
    # The workflow job must run in the GitHub environment named after the workspace.
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:${var.github_repository}:environment:${terraform.workspace}"]
    }
  }
}

resource "aws_iam_role" "github_deploy" {
  name               = "${local.name}-github-deploy"
  assume_role_policy = data.aws_iam_policy_document.github_trust.json
}

data "aws_iam_policy_document" "github_deploy" {
  statement {
    actions   = ["ecr:GetAuthorizationToken"]
    resources = ["*"]
  }
  statement {
    actions = [
      "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer",
    ]
    resources = ["arn:aws:ecr:${var.region}:${data.aws_caller_identity.current.account_id}:repository/pocketcoffee/*"]
  }
  statement {
    actions   = ["eks:DescribeCluster"]
    resources = [module.eks.cluster_arn]
  }
}

resource "aws_iam_role_policy" "github_deploy" {
  role   = aws_iam_role.github_deploy.id
  policy = data.aws_iam_policy_document.github_deploy.json
}

# Containers only: scripts/seed-secrets.sh writes the values, so the crypt key and the passwords
# never appear in the configuration, and the crypt key never appears in the state.
resource "aws_secretsmanager_secret" "magento" {
  name        = "${local.secret_prefix}/magento"
  description = "db_app_password, db_migrate_password, crypt_key, opensearch_password, valkey_cache_auth_token, valkey_session_auth_token, amqp_password"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

# The first administrator's password, read once by the install Job; delete it afterwards.
resource "aws_secretsmanager_secret" "install" {
  name        = "${local.secret_prefix}/magento-install"
  description = "ADMIN_PASSWORD for the first install"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

data "aws_route53_zone" "root" {
  name         = var.root_domain
  private_zone = false
}

# Regional certificate for the load balancer. The apex redirects to www in production.
resource "aws_acm_certificate" "site" {
  domain_name               = local.cfg.site_host
  validation_method         = "DNS"
  subject_alternative_names = local.env == "prod" ? [var.root_domain] : []

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "site_validation" {
  for_each = {
    for o in aws_acm_certificate.site.domain_validation_options : o.domain_name => {
      name   = o.resource_record_name
      type   = o.resource_record_type
      record = o.resource_record_value
    }
  }

  zone_id         = data.aws_route53_zone.root.zone_id
  name            = each.value.name
  type            = each.value.type
  records         = [each.value.record]
  ttl             = 60
  allow_overwrite = true
}

resource "aws_acm_certificate_validation" "site" {
  certificate_arn         = aws_acm_certificate.site.arn
  validation_record_fqdns = [for r in aws_route53_record.site_validation : r.fqdn]
}

# Certificate of the media host for CloudFront: it must live in us-east-1.
resource "aws_acm_certificate" "media" {
  provider = aws.us_east_1

  domain_name       = local.cfg.media_host
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "media_validation" {
  for_each = {
    for o in aws_acm_certificate.media.domain_validation_options : o.domain_name => {
      name   = o.resource_record_name
      type   = o.resource_record_type
      record = o.resource_record_value
    }
  }

  zone_id         = data.aws_route53_zone.root.zone_id
  name            = each.value.name
  type            = each.value.type
  records         = [each.value.record]
  ttl             = 60
  allow_overwrite = true
}

resource "aws_acm_certificate_validation" "media" {
  provider = aws.us_east_1

  certificate_arn         = aws_acm_certificate.media.arn
  validation_record_fqdns = [for r in aws_route53_record.media_validation : r.fqdn]
}

locals {
  waf_rules = [
    # SizeRestrictions_BODY blocks any request body over 8 KB, which every Admin product form exceeds.
    { name = "AWSManagedRulesCommonRuleSet", priority = 10, count_overrides = ["SizeRestrictions_BODY"] },
    { name = "AWSManagedRulesKnownBadInputsRuleSet", priority = 20, count_overrides = [] },
    { name = "AWSManagedRulesSQLiRuleSet", priority = 30, count_overrides = [] },
    { name = "AWSManagedRulesPHPRuleSet", priority = 40, count_overrides = [] },
  ]
}

resource "aws_wafv2_ip_set" "admin" {
  name               = "${local.name}-admin"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  addresses          = var.admin_cidrs
}

# Regional web ACL, attached to the load balancer.
resource "aws_wafv2_web_acl" "alb" {
  name  = local.name
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  # The Admin answers only to the office and VPN addresses.
  rule {
    name     = "admin-allow-list"
    priority = 1

    action {
      block {}
    }

    statement {
      and_statement {
        statement {
          byte_match_statement {
            search_string         = "/${var.admin_front_name}"
            positional_constraint = "STARTS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "LOWERCASE"
            }
          }
        }
        statement {
          not_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.admin.arn
              }
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "admin-allow-list"
      sampled_requests_enabled   = true
    }
  }

  # The REST endpoint that trades an administrator's password for a token bypasses the Admin URL.
  rule {
    name     = "admin-token-allow-list"
    priority = 2

    action {
      block {}
    }

    statement {
      and_statement {
        statement {
          byte_match_statement {
            search_string         = "/v1/integration/admin/token"
            positional_constraint = "ENDS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "LOWERCASE"
            }
          }
        }
        statement {
          not_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.admin.arn
              }
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "admin-token-allow-list"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "login-rate-limit"
    priority = 3

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 100
        aggregate_key_type = "IP"
        scope_down_statement {
          byte_match_statement {
            search_string         = "/customer/account/login"
            positional_constraint = "STARTS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "LOWERCASE"
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "login-rate-limit"
      sampled_requests_enabled   = true
    }
  }

  dynamic "rule" {
    for_each = local.waf_rules
    content {
      name     = rule.value.name
      priority = rule.value.priority

      override_action {
        none {}
      }

      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = "AWS"

          dynamic "rule_action_override" {
            for_each = rule.value.count_overrides
            content {
              name = rule_action_override.value
              action_to_use {
                count {}
              }
            }
          }
        }
      }

      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = rule.value.name
        sampled_requests_enabled   = true
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = local.name
    sampled_requests_enabled   = true
  }
}

output "cluster_name" {
  value = module.eks.cluster_name
}

output "db_endpoint" {
  description = "Goes into the Helm value database.host."
  value       = module.db.db_instance_address
}

output "db_master_secret_arn" {
  value = module.db.db_instance_master_user_secret_arn
}

output "opensearch_endpoint" {
  description = "Goes into the OpenSearch host of the environment (MAGENTO_OPENSEARCH_HOST)."
  value       = aws_opensearch_domain.main.endpoint
}

output "valkey_cache_endpoint" {
  value = aws_elasticache_replication_group.cache.primary_endpoint_address
}

output "valkey_session_endpoint" {
  value = aws_elasticache_replication_group.session.primary_endpoint_address
}

output "amqp_host" {
  description = "Host name of the RabbitMQ endpoint (amqps, port 5671)."
  value       = regex("^amqps://([^:/]+)", aws_mq_broker.main.instances[0].endpoints[0])[0]
}

output "media_bucket" {
  value = aws_s3_bucket.media.bucket
}

output "media_certificate_arn" {
  description = "Certificate for the media host, in us-east-1, for CloudFront."
  value       = aws_acm_certificate_validation.media.certificate_arn
}

output "efs_file_system_id" {
  description = "Goes into the Helm value media.efs.fileSystemId (media_mode = efs)."
  value       = module.efs.id
}

output "efs_access_point_id" {
  description = "Goes into the Helm value media.efs.accessPointId (media_mode = efs)."
  value       = try(module.efs.access_points["media"].id, "")
}

output "site_certificate_arn" {
  value = aws_acm_certificate_validation.site.certificate_arn
}

output "waf_acl_arn" {
  value = aws_wafv2_web_acl.alb.arn
}

output "ecr_repository_urls" {
  value = { for k, m in module.ecr : k => m.repository_url }
}

output "github_deploy_role_arn" {
  value = aws_iam_role.github_deploy.arn
}

# Sensitive: read by scripts/seed-secrets.sh, never printed by it.
output "opensearch_master_password" {
  value     = random_password.search.result
  sensitive = true
}

output "valkey_auth_tokens" {
  value     = { for k, p in random_password.valkey : k => p.result }
  sensitive = true
}

output "amqp_password" {
  value     = random_password.mq.result
  sensitive = true
}

cd infra
tofu init -backend-config="bucket=pocketcoffee-tfstate-123456789012"
tofu workspace select -or-create staging
tofu plan -out=staging.plan
tofu apply staging.plan

# Offline check, without credentials or a backend (one workspace at a time):
tofu init -backend=false
tofu fmt -check
TF_WORKSPACE=staging tofu validate
TF_WORKSPACE=production tofu validate

# nginx container of the pod; PHP-FPM listens on 127.0.0.1:9000 in the same pod.
upstream fastcgi_backend {
    server 127.0.0.1:9000;
}

set_real_ip_from {{ .Values.shop.trustedProxies }};
real_ip_header X-Forwarded-For;
real_ip_recursive on;

server {
    listen 8080 default_server;
    server_name _;
    server_tokens off;
    client_max_body_size 32M;

    set $MAGE_ROOT /var/www/html;
    set $MAGE_DEBUG_SHOW_ARGS 0;

    # Liveness: answered by nginx itself, no PHP, no database.
    location = /healthz { access_log off; default_type text/plain; return 200 "ok\n"; }
    # Readiness uses /health_check.php of Magento, which the included file already routes to PHP-FPM.

    # The web installer and updater are never reachable in a cluster; ^~ wins over the regexes of the sample.
    location ^~ /setup { return 404; }
    location ^~ /update { return 404; }

    include /var/www/html/nginx.conf.sample;
}

; Loaded after the image's own pool files, so these values win.
[global]
error_log = /proc/self/fd/2

[www]
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 24
pm.start_servers = 6
pm.min_spare_servers = 4
pm.max_spare_servers = 10
pm.max_requests = 500
request_terminate_timeout = 300s
ping.path = /fpm-ping
ping.response = pong
catch_workers_output = yes
decorate_workers_output = no
; The pod environment (ConfigMap and Secret) must reach the workers: env.php reads it with getenv().
clear_env = no

; Loaded last (zz-), so these values win over the image's own.
memory_limit = 768M
max_execution_time = 120
realpath_cache_size = 10M
realpath_cache_ttl = 7200
opcache.enable = 1
opcache.enable_cli = 1
opcache.validate_timestamps = 0
opcache.memory_consumption = 512
opcache.max_accelerated_files = 100000
opcache.interned_strings_buffer = 32
session.auto_start = 0

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-env
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  MAGENTO_MODE: {{ .Values.shop.mode | quote }}
  MAGENTO_BASE_URL: {{ printf "https://%s/" .Values.shop.domain | quote }}
  MAGENTO_BACKEND_FRONTNAME: {{ .Values.shop.adminFrontName | quote }}
  MAGENTO_GRAPHQL_ID_SALT: {{ .Values.shop.graphqlIdSalt | quote }}
  MAGENTO_DB_HOST: {{ required "set database.host" .Values.database.host | quote }}
  MAGENTO_DB_PORT: {{ .Values.database.port | quote }}
  MAGENTO_DB_NAME: {{ .Values.database.name | quote }}
  MAGENTO_DB_USER: {{ .Values.database.appUser | quote }}
  MAGENTO_MIGRATE_DB_USER: {{ .Values.database.migrateUser | quote }}
  {{- if .Values.database.sslCa }}
  MAGENTO_DB_SSL_CA: {{ .Values.database.sslCa | quote }}
  {{- end }}
  MAGENTO_OPENSEARCH_HOST: {{ required "set opensearch.host" .Values.opensearch.host | quote }}
  MAGENTO_OPENSEARCH_PORT: {{ .Values.opensearch.port | quote }}
  MAGENTO_OPENSEARCH_USER: {{ .Values.opensearch.user | quote }}
  MAGENTO_OPENSEARCH_PREFIX: {{ .Values.opensearch.indexPrefix | quote }}
  MAGENTO_VALKEY_CACHE_HOST: {{ required "set valkey.cacheHost" .Values.valkey.cacheHost | quote }}
  MAGENTO_VALKEY_SESSION_HOST: {{ required "set valkey.sessionHost" .Values.valkey.sessionHost | quote }}
  MAGENTO_VALKEY_PORT: {{ .Values.valkey.port | quote }}
  MAGENTO_AMQP_HOST: {{ required "set amqp.host" .Values.amqp.host | quote }}
  MAGENTO_AMQP_PORT: {{ .Values.amqp.port | quote }}
  MAGENTO_AMQP_USER: {{ .Values.amqp.user | quote }}
  MAGENTO_AMQP_VHOST: {{ .Values.amqp.vhost | quote }}
  MAGENTO_VARNISH_HOSTS: {{ include "pc.varnishHosts" . | quote }}
  {{- if eq .Values.media.mode "s3" }}
  MAGENTO_S3_BUCKET: {{ required "set media.bucket" .Values.media.bucket | quote }}
  MAGENTO_S3_REGION: {{ .Values.media.region | quote }}
  {{- if .Values.media.baseUrl }}
  MAGENTO_MEDIA_BASE_URL: {{ .Values.media.baseUrl | quote }}
  {{- end }}
  {{- end }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-env-php
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  env.php: |
    {{- .Files.Get "files/env.php" | nindent 4 }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-nginx
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  default.conf: |
    {{- tpl (.Files.Get "files/default.conf") . | nindent 4 }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-php
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  php.ini: |
    {{- .Files.Get "files/php.ini" | nindent 4 }}
  php-fpm.conf: |
    {{- .Files.Get "files/php-fpm.conf" | nindent 4 }}
{{- if .Values.varnish.enabled }}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-varnish-vcl
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  default.vcl: |
    {{- .Files.Get "files/default.vcl" | nindent 4 }}
{{- end }}

{{- if .Values.secrets.enabled }}
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ .Values.secrets.name }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.secrets.refreshInterval }}
  secretStoreRef:
    kind: ClusterSecretStore
    name: {{ .Values.secrets.storeName }}
  target:
    name: {{ .Values.secrets.name }}
    creationPolicy: Owner
  # One Kubernetes Secret; every key is an environment variable of env.php (see the table in the text).
  data:
    - secretKey: MAGENTO_DB_PASSWORD
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: db_app_password }
    - secretKey: MAGENTO_MIGRATE_DB_PASSWORD
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: db_migrate_password }
    - secretKey: MAGENTO_CRYPT_KEY
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: crypt_key }
    - secretKey: MAGENTO_OPENSEARCH_PASSWORD
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: opensearch_password }
    - secretKey: MAGENTO_VALKEY_CACHE_AUTH_TOKEN
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: valkey_cache_auth_token }
    - secretKey: MAGENTO_VALKEY_SESSION_AUTH_TOKEN
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: valkey_session_auth_token }
    - secretKey: MAGENTO_AMQP_PASSWORD
      remoteRef: { key: {{ .Values.secrets.remoteKey }}, property: amqp_password }
{{- if .Values.install.enabled }}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ .Release.Name }}-install
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.secrets.refreshInterval }}
  secretStoreRef:
    kind: ClusterSecretStore
    name: {{ .Values.secrets.storeName }}
  target:
    name: {{ .Release.Name }}-install
    creationPolicy: Owner
  dataFrom:
    - extract:
        key: {{ .Values.secrets.installRemoteKey }}
{{- end }}
{{- end }}

{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "pc.serviceAccountName" . }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
# The IAM role comes from the Pod Identity association of the infrastructure, not from an annotation.
automountServiceAccountToken: false
{{- end }}

{{- if eq .Values.media.mode "efs" }}
# Static provisioning: the PV names the EFS access point from OpenTofu (UID/GID 33).
apiVersion: v1
kind: PersistentVolume
metadata:
  name: {{ .Release.Namespace }}-{{ .Values.media.claimName }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  capacity:
    storage: {{ .Values.media.size }}
  accessModes: [ReadWriteMany]
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ""
  csi:
    driver: efs.csi.aws.com
    volumeHandle: {{ required "set media.efs.fileSystemId" .Values.media.efs.fileSystemId }}::{{ required "set media.efs.accessPointId" .Values.media.efs.accessPointId }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ .Values.media.claimName }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  accessModes: [ReadWriteMany]
  storageClassName: ""
  volumeName: {{ .Release.Namespace }}-{{ .Values.media.claimName }}
  resources:
    requests:
      storage: {{ .Values.media.size }}
{{- end }}

{{ include "pc.webDeployment" (dict "root" . "component" "web" "replicas" .Values.web.replicas "resources" .Values.web.phpFpm.resources "hpa" .Values.autoscaling.enabled) }}
{{- if .Values.admin.enabled }}
---
{{ include "pc.webDeployment" (dict "root" . "component" "admin" "replicas" .Values.admin.replicas "resources" .Values.admin.resources "hpa" false) }}
{{- end }}

{{/* One web-tier Deployment: include "pc.webDeployment" (dict "root" . "component" "web" "replicas" 2 "resources" ... "hpa" true). */}}
{{- define "pc.webDeployment" -}}
{{- $root := .root -}}
{{- $c := .component -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $root.Release.Name }}-{{ $c }}
  labels:
    {{- include "pc.labels" $root | nindent 4 }}
    app.kubernetes.io/component: {{ $c }}
spec:
  {{- if $root.Values.install.enabled }}
  replicas: 0   # no web pod while the installer runs
  {{- else if not .hpa }}
  replicas: {{ .replicas }}
  {{- end }}
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" $root "component" $c) | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" $root "component" $c) | nindent 8 }}
      annotations:
        checksum/config: {{ include (print $root.Template.BasePath "/configmap.yaml") $root | sha256sum }}
    spec:
      serviceAccountName: {{ include "pc.serviceAccountName" $root }}
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: {{ $root.Values.web.terminationGracePeriodSeconds }}
      securityContext:
        {{- include "pc.podSecurity" $root | nindent 8 }}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              {{- include "pc.selector" (dict "root" $root "component" $c) | nindent 14 }}
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              {{- include "pc.selector" (dict "root" $root "component" $c) | nindent 14 }}
      containers:
        - name: php-fpm
          image: {{ include "pc.image" $root }}
          imagePullPolicy: {{ $root.Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" $root | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          ports:
            - name: fastcgi
              containerPort: 9000
          envFrom:
            {{- include "pc.envFrom" $root | nindent 12 }}
          livenessProbe:
            tcpSocket:
              port: fastcgi
            periodSeconds: 10
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "10"]
          resources:
            {{- toYaml .resources | nindent 12 }}
          volumeMounts:
            {{- include "pc.phpMounts" $root | nindent 12 }}
            - name: php
              mountPath: /usr/local/etc/php-fpm.d/zz-pocketcoffee.conf
              subPath: php-fpm.conf
              readOnly: true
        - name: nginx
          image: {{ include "pc.nginxImage" $root }}
          imagePullPolicy: {{ $root.Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" $root | nindent 12 }}
            runAsUser: 101
            runAsGroup: 101
          ports:
            - name: http
              containerPort: 8080
          # Magento's own check: it opens the database and every cache backend of env.php.
          startupProbe:
            httpGet:
              path: /health_check.php
              port: http
            periodSeconds: 5
            failureThreshold: 36
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health_check.php
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "10"]
          resources:
            {{- toYaml $root.Values.web.nginx.resources | nindent 12 }}
          volumeMounts:
            - { name: nginx-tmp, mountPath: /tmp }
            - { name: media, mountPath: /var/www/html/pub/media, readOnly: true }
            - name: nginx
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
              readOnly: true
      volumes:
        {{- include "pc.phpVolumes" $root | nindent 8 }}
        - { name: nginx-tmp, emptyDir: { sizeLimit: 128Mi } }
        - name: nginx
          configMap:
            name: {{ $root.Release.Name }}-nginx
{{- end -}}

apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    {{- include "pc.selector" (dict "root" . "component" "web") | nindent 4 }}
  ports:
    - name: http
      port: 8080
      targetPort: http
{{- if .Values.admin.enabled }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-admin
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    {{- include "pc.selector" (dict "root" . "component" "admin") | nindent 4 }}
  ports:
    - name: http
      port: 8080
      targetPort: http
{{- end }}

{{- if .Values.varnish.enabled }}
# Customer traffic enters here (port 80 to the Varnish port 6081).
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-varnish
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 4 }}
  ports:
    - name: http
      port: 80
      targetPort: http
---
# Stable pod DNS names, so that Magento can send a purge to every replica.
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-varnish-headless
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  clusterIP: None
  selector:
    {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 4 }}
  ports:
    - name: http
      port: 6081
      targetPort: http
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ .Release.Name }}-varnish
  labels:
    {{- include "pc.labels" . | nindent 4 }}
    app.kubernetes.io/component: varnish
spec:
  serviceName: {{ .Release.Name }}-varnish-headless
  # A StatefulSet only for the pod names: the cache is memory-only and starts empty.
  replicas: {{ ternary 0 .Values.varnish.replicas .Values.install.enabled }}
  podManagementPolicy: Parallel
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 8 }}
      annotations:
        checksum/vcl: {{ .Files.Get "files/default.vcl" | sha256sum }}
    spec:
      serviceAccountName: {{ include "pc.serviceAccountName" . }}
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 14 }}
      containers:
        - name: varnish
          image: {{ .Values.varnish.image.repository }}:{{ .Values.varnish.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
          # The official image's entrypoint builds the varnishd command line from these variables.
          env:
            - { name: VARNISH_HTTP_PORT, value: "6081" }
            - { name: VARNISH_SIZE, value: {{ .Values.varnish.size | quote }} }
          ports:
            - name: http
              containerPort: 6081
          readinessProbe:
            tcpSocket:
              port: http
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: http
            periodSeconds: 10
            failureThreshold: 6
          resources:
            {{- toYaml .Values.varnish.resources | nindent 12 }}
          volumeMounts:
            - { name: vcl, mountPath: /etc/varnish/default.vcl, subPath: default.vcl, readOnly: true }
            - { name: workdir, mountPath: /var/lib/varnish }
            - { name: tmp, mountPath: /tmp }
      volumes:
        - name: vcl
          configMap:
            name: {{ .Release.Name }}-varnish-vcl
        - { name: workdir, emptyDir: { medium: Memory, sizeLimit: 128Mi } }
        - { name: tmp, emptyDir: { sizeLimit: 64Mi } }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ .Release.Name }}-varnish
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" . "component" "varnish") | nindent 6 }}
{{- end }}

{{- if .Values.httpRoute.enabled }}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-www
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  parentRefs:
    - name: {{ .Values.httpRoute.parentRef.name }}
      namespace: {{ .Values.httpRoute.parentRef.namespace }}
  hostnames:
    - {{ .Values.shop.domain }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ if .Values.varnish.enabled }}varnish{{ else }}web{{ end }}
          port: {{ if .Values.varnish.enabled }}80{{ else }}8080{{ end }}
---
# The Admin bypasses Varnish: nothing in it may be cached. The longer prefix wins over "/".
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-admin
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  parentRefs:
    - name: {{ .Values.httpRoute.parentRef.name }}
      namespace: {{ .Values.httpRoute.parentRef.namespace }}
  hostnames:
    - {{ .Values.shop.domain }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /{{ .Values.shop.adminFrontName }}
      backendRefs:
        - name: {{ .Release.Name }}-{{ if .Values.admin.enabled }}admin{{ else }}web{{ end }}
          port: 8080
{{- if .Values.httpRoute.redirectApex }}
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-apex
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  parentRefs:
    - name: {{ .Values.httpRoute.parentRef.name }}
      namespace: {{ .Values.httpRoute.parentRef.namespace }}
  hostnames:
    - {{ .Values.httpRoute.apexHost }}
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            hostname: {{ .Values.shop.domain }}
            statusCode: 301
{{- end }}
{{- end }}

{{- if and .Values.autoscaling.enabled (not .Values.install.enabled) }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ .Release.Name }}-web
  minReplicas: {{ .Values.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
---
{{- end }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" . "component" "web") | nindent 6 }}
{{- if .Values.admin.enabled }}
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ .Release.Name }}-admin
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" . "component" "admin") | nindent 6 }}
{{- end }}

{{- range .Values.consumers }}
{{- $slug := include "pc.consumerSlug" .name }}
{{- $component := printf "consumer-%s" $slug }}
{{- $name := printf "%s-consumer-%s" $.Release.Name $slug }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $name }}
  labels:
    {{- include "pc.labels" $ | nindent 4 }}
    app.kubernetes.io/component: {{ $component }}
spec:
  {{- if $.Values.install.enabled }}
  replicas: 0
  {{- else if not $.Values.keda.enabled }}
  replicas: {{ .minReplicas }}
  {{- end }}
  revisionHistoryLimit: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0
  selector:
    matchLabels:
      {{- include "pc.selector" (dict "root" $ "component" $component) | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" $ "component" $component) | nindent 8 }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") $ | sha256sum }}
    spec:
      serviceAccountName: {{ include "pc.serviceAccountName" $ }}
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: {{ $.Values.consumer.terminationGracePeriodSeconds }}
      securityContext:
        {{- include "pc.podSecurity" $ | nindent 8 }}
      containers:
        - name: consumer
          image: {{ include "pc.image" $ }}
          imagePullPolicy: {{ $.Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" $ | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          # exec: the consumer is PID 1 and receives SIGTERM. It exits after maxMessages and the kubelet restarts it.
          command: ["sh", "-c"]
          args:
            - exec bin/magento queue:consumers:start {{ .name }} --max-messages={{ .maxMessages }}
          workingDir: /var/www/html
          envFrom:
            {{- include "pc.envFrom" $ | nindent 12 }}
          env:
            # Consumers can trigger partial reindexing, which truncates and creates index tables.
            {{- include "pc.dbEnv" (dict "root" $ "user" $.Values.database.migrateUser "key" "MAGENTO_MIGRATE_DB_PASSWORD") | nindent 12 }}
          resources:
            {{- toYaml $.Values.consumer.resources | nindent 12 }}
          volumeMounts:
            {{- include "pc.phpMounts" $ | nindent 12 }}
      volumes:
        {{- include "pc.phpVolumes" $ | nindent 8 }}
{{- if and $.Values.keda.enabled (not $.Values.install.enabled) }}
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: {{ $name }}
  labels:
    {{- include "pc.labels" $ | nindent 4 }}
spec:
  scaleTargetRef:
    name: {{ $name }}
  minReplicaCount: {{ .minReplicas }}
  maxReplicaCount: {{ .maxReplicas }}
  pollingInterval: {{ $.Values.keda.pollingIntervalSeconds }}
  cooldownPeriod: {{ $.Values.keda.cooldownPeriodSeconds }}
  triggers:
    - type: rabbitmq
      metadata:
        protocol: http
        host: {{ required "set keda.managementUrl" $.Values.keda.managementUrl | quote }}
        vhostName: {{ $.Values.amqp.vhost | quote }}
        queueName: {{ .queue | quote }}
        mode: QueueLength
        value: {{ .messagesPerReplica | default 100 | quote }}
        # The management API is called with the broker user of env.php, read from the target's environment.
        usernameFromEnv: MAGENTO_AMQP_USER
        passwordFromEnv: MAGENTO_AMQP_PASSWORD
{{- end }}
---
{{- end }}

{{- if .Values.cron.enabled }}
apiVersion: batch/v1
kind: CronJob
metadata:
  name: {{ .Release.Name }}-cron
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  schedule: {{ .Values.cron.schedule | quote }}
  concurrencyPolicy: Forbid
  suspend: {{ .Values.install.enabled }}
  startingDeadlineSeconds: 120
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: {{ .Values.cron.activeDeadlineSeconds }}
      ttlSecondsAfterFinished: 3600
      template:
        metadata:
          labels:
            {{- include "pc.selector" (dict "root" . "component" "cron") | nindent 12 }}
        spec:
          restartPolicy: Never
          serviceAccountName: {{ include "pc.serviceAccountName" . }}
          automountServiceAccountToken: false
          securityContext:
            {{- include "pc.podSecurity" . | nindent 12 }}
          containers:
            - name: cron
              image: {{ include "pc.image" . }}
              imagePullPolicy: {{ .Values.image.pullPolicy }}
              securityContext:
                {{- include "pc.containerSecurity" . | nindent 16 }}
                runAsUser: 33
                runAsGroup: 33
              command: ["sh", "-c"]
              args:
                - |
                  set -eu
                  cd /var/www/html
                  {{- if .Values.cron.groups }}
                  {{- range .Values.cron.groups }}
                  bin/magento cron:run --group={{ . }} --bootstrap=standaloneProcessStarted=1
                  {{- end }}
                  {{- else }}
                  bin/magento cron:run
                  {{- end }}
              envFrom:
                {{- include "pc.envFrom" . | nindent 16 }}
              env:
                # The index cron group reindexes, which truncates and creates index tables.
                {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "MAGENTO_MIGRATE_DB_PASSWORD") | nindent 16 }}
              resources:
                {{- toYaml .Values.cron.resources | nindent 16 }}
              volumeMounts:
                {{- include "pc.phpMounts" . | nindent 16 }}
          volumes:
            {{- include "pc.phpVolumes" . | nindent 12 }}
{{- end }}

{{- if .Values.migrate.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-migrate
  labels:
    {{- include "pc.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 0
  activeDeadlineSeconds: {{ .Values.migrate.activeDeadlineSeconds }}
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" . "component" "migrate") | nindent 8 }}
    spec:
      restartPolicy: Never
      serviceAccountName: {{ include "pc.serviceAccountName" . }}
      automountServiceAccountToken: false
      securityContext:
        {{- include "pc.podSecurity" . | nindent 8 }}
      # setup:upgrade wants a writable app/etc; the image's config.php is copied into a throwaway directory.
      initContainers:
        - name: etc
          image: {{ include "pc.image" . }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          command: ["sh", "-c", "cp -a /var/www/html/app/etc/. /etc-work/"]
          volumeMounts:
            - { name: etc-work, mountPath: /etc-work }
      containers:
        - name: upgrade
          image: {{ include "pc.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          workingDir: /var/www/html
          command: ["sh", "-c"]
          args:
            - |
              set -u
              # 0 = schema and data are current, 2 = upgrade required, anything else = failure.
              rc=0
              bin/magento setup:db:status --no-interaction || rc=$?
              if [ "$rc" -eq 0 ]; then
                echo "Database is up to date; nothing to do."
              elif [ "$rc" -eq 2 ]; then
                exec bin/magento setup:upgrade --keep-generated --no-interaction
              else
                echo "setup:db:status failed with exit code $rc" >&2
                exit "$rc"
              fi
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "MAGENTO_MIGRATE_DB_PASSWORD") | nindent 12 }}
          resources:
            requests: { cpu: 500m, memory: 1Gi }
            limits: { memory: 2Gi }
          volumeMounts:
            {{- include "pc.phpMounts" . | nindent 12 }}
            - { name: etc-work, mountPath: /var/www/html/app/etc }
      volumes:
        {{- include "pc.phpVolumes" . | nindent 8 }}
        - { name: etc-work, emptyDir: { sizeLimit: 64Mi } }
{{- end }}

{{- if .Values.install.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-install
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 2400
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" . "component" "install") | nindent 8 }}
    spec:
      restartPolicy: Never
      serviceAccountName: {{ include "pc.serviceAccountName" . }}
      automountServiceAccountToken: false
      securityContext:
        {{- include "pc.podSecurity" . | nindent 8 }}
      # The installer writes app/etc/env.php: it gets a throwaway copy of app/etc, discarded with the pod.
      initContainers:
        - name: etc
          image: {{ include "pc.image" . }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          command: ["sh", "-c", "cp -a /var/www/html/app/etc/. /etc-work/"]
          volumeMounts:
            - { name: etc-work, mountPath: /etc-work }
      containers:
        - name: install
          image: {{ include "pc.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          workingDir: /var/www/html
          command: ["sh", "-c"]
          args:
            - |
              set -eu
              # Refuse to install over an existing shop: setup:install would try to reuse its tables.
              rc=0
              php -r '
                $pdo = new PDO(
                  "mysql:host=" . getenv("MAGENTO_DB_HOST") . ";port=" . getenv("MAGENTO_DB_PORT") . ";dbname=" . getenv("MAGENTO_DB_NAME"),
                  getenv("MAGENTO_DB_USER"), getenv("MAGENTO_DB_PASSWORD"));
                exit($pdo->query("SHOW TABLES LIKE \"core_config_data\"")->rowCount() > 0 ? 3 : 0);
              ' || rc=$?
              if [ "$rc" -eq 3 ]; then
                echo "core_config_data exists: this database already holds a shop" >&2
                exit 3
              elif [ "$rc" -ne 0 ]; then
                echo "could not query the database (exit code $rc)" >&2
                exit "$rc"
              fi
              bin/magento setup:install --no-interaction \
                --base-url="$MAGENTO_BASE_URL" \
                --db-host="$MAGENTO_DB_HOST:$MAGENTO_DB_PORT" --db-name="$MAGENTO_DB_NAME" \
                --db-user="$MAGENTO_DB_USER" --db-password="$MAGENTO_DB_PASSWORD" \
                --key="$MAGENTO_CRYPT_KEY" --backend-frontname="$MAGENTO_BACKEND_FRONTNAME" \
                --search-engine=opensearch --opensearch-host="https://$MAGENTO_OPENSEARCH_HOST" \
                --opensearch-port="$MAGENTO_OPENSEARCH_PORT" --opensearch-enable-auth=1 \
                --opensearch-username="$MAGENTO_OPENSEARCH_USER" --opensearch-password="$MAGENTO_OPENSEARCH_PASSWORD" \
                --opensearch-index-prefix="$MAGENTO_OPENSEARCH_PREFIX" --opensearch-timeout=15 \
                --admin-firstname={{ .Values.install.adminFirstname | quote }} --admin-lastname={{ .Values.install.adminLastname | quote }} \
                --admin-email={{ .Values.install.adminEmail | quote }} --admin-user={{ .Values.install.adminUser | quote }} \
                --admin-password="$ADMIN_PASSWORD" \
                --language={{ .Values.install.language }} --currency={{ .Values.install.currency }} \
                --timezone={{ .Values.install.timezone }} --use-rewrites=1
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "MAGENTO_MIGRATE_DB_PASSWORD") | nindent 12 }}
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-install
                  key: ADMIN_PASSWORD
          resources:
            requests: { cpu: "1", memory: 2Gi }
            limits: { memory: 3Gi }
          volumeMounts:
            - { name: tmp, mountPath: /tmp }
            - { name: var, mountPath: /var/www/html/var }
            - { name: media, mountPath: /var/www/html/pub/media }
            - { name: etc-work, mountPath: /var/www/html/app/etc }
            - { name: php, mountPath: /usr/local/etc/php/conf.d/zz-pocketcoffee.ini, subPath: php.ini, readOnly: true }
      volumes:
        - { name: tmp, emptyDir: { sizeLimit: 256Mi } }
        - { name: var, emptyDir: { sizeLimit: 2Gi } }
        - { name: media, emptyDir: { sizeLimit: 512Mi } }
        - { name: etc-work, emptyDir: { sizeLimit: 64Mi } }
        - name: php
          configMap:
            name: {{ .Release.Name }}-php
{{- end }}

{{- if .Values.reindex.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-reindex{{ if .Values.reindex.run }}-{{ .Values.reindex.run }}{{ end }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 14400
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        {{- include "pc.selector" (dict "root" . "component" "reindex") | nindent 8 }}
    spec:
      restartPolicy: Never
      serviceAccountName: {{ include "pc.serviceAccountName" . }}
      automountServiceAccountToken: false
      securityContext:
        {{- include "pc.podSecurity" . | nindent 8 }}
      containers:
        - name: reindex
          image: {{ include "pc.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          workingDir: /var/www/html
          command: ["sh", "-c"]
          args:
            - exec bin/magento indexer:reindex {{ join " " .Values.reindex.indexers }}
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            # Reindexing creates and swaps index tables, which the runtime user may not do.
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "MAGENTO_MIGRATE_DB_PASSWORD") | nindent 12 }}
          resources:
            requests: { cpu: "1", memory: 2Gi }
            limits: { memory: 4Gi }
          volumeMounts:
            {{- include "pc.phpMounts" . | nindent 12 }}
      volumes:
        {{- include "pc.phpVolumes" . | nindent 8 }}
{{- end }}

kubectl -n pocketcoffee get pods -o wide
kubectl -n pocketcoffee get httproute,scaledobject
curl -fsS -o /dev/null -w '%{http_code}\n' https://www.pocketcoffee.example/
curl -fsS https://www.pocketcoffee.example/health_check.php -o /dev/null -w '%{http_code}\n'
curl -fsSI https://www.pocketcoffee.example/admin_pocketcoffee/ | head -n 1   # 403 from outside the allow-list
kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- bin/magento config:show web/secure/base_url
kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- bin/magento cache:status
kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- bin/magento queue:consumers:list