Cloud: EKS Infrastructure and Helm Deployment

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.70"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.7"
    }
  }

  # Partial configuration: the bucket is passed with -backend-config.
  backend "s3" {
    key                  = "prestashop/pocketcoffee.tfstate"
    workspace_key_prefix = "workspaces"
    region               = "eu-west-1"
    encrypt              = true
    use_lockfile         = true
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = {
      Project     = "pocketcoffee-prestashop"
      Environment = local.env
      ManagedBy   = "opentofu"
    }
  }
}

variable "region" {
  description = "Region of the cluster and of every regional resource."
  type        = string
  default     = "eu-west-1"
}

variable "root_domain" {
  description = "Public Route 53 hosted zone that already exists."
  type        = string
  default     = "pocketcoffee.example"
}

variable "admin_cidrs" {
  description = "CIDR blocks allowed to reach the public Kubernetes API endpoint and the back office."
  type        = list(string)
  default     = ["203.0.113.0/24"]
}

variable "github_repository" {
  description = "Repository whose workflows may push images to ECR (OIDC subject)."
  type        = string
  default     = "pocketcoffee/prestashop-shop"
}

variable "admin_dir" {
  description = "Renamed back-office folder, used by the WAF rule that restricts it."
  type        = string
  default     = "admin-pocketcoffee"
}

data "aws_caller_identity" "current" {}
data "aws_availability_zones" "available" {
  state = "available"
}

locals {
  # One workspace per environment; "default" is deliberately not a key.
  environments = {
    staging = {
      env                 = "staging"
      site_host           = "staging.pocketcoffee.example"
      vpc_cidr            = "10.30.0.0/16"
      single_nat          = true
      kubernetes_version  = "1.36"
      db_instance_class   = "db.t4g.medium"
      db_multi_az         = false
      db_allocated_gb     = 50
      db_deletion_protect = false
      valkey_node_type    = "cache.t4g.small"
      valkey_replicas     = 1
      memcached_node_type = "cache.t4g.small"
      memcached_nodes     = 1
    }
    production = {
      env                 = "prod"
      site_host           = "www.pocketcoffee.example"
      vpc_cidr            = "10.10.0.0/16"
      single_nat          = false
      kubernetes_version  = "1.36"
      db_instance_class   = "db.r7g.large"
      db_multi_az         = true
      db_allocated_gb     = 200
      db_deletion_protect = true
      valkey_node_type    = "cache.r7g.large"
      valkey_replicas     = 2
      memcached_node_type = "cache.r7g.large"
      memcached_nodes     = 2
    }
  }

  cfg  = local.environments[terraform.workspace]
  env  = local.cfg.env
  name = "pocketcoffee-${local.env}"
  azs  = slice(data.aws_availability_zones.available.names, 0, 3)

  # Secrets Manager names follow pocketcoffee/<env>/<purpose>.
  secret_prefix = "pocketcoffee/${local.env}"
}

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "6.7.3"

  name = local.name
  cidr = local.cfg.vpc_cidr
  azs  = local.azs

  public_subnets      = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i)]
  private_subnets     = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 4, i + 1)]
  database_subnets    = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i + 100)]
  elasticache_subnets = [for i in range(3) : cidrsubnet(local.cfg.vpc_cidr, 8, i + 110)]

  create_database_subnet_group    = true
  create_elasticache_subnet_group = true

  enable_nat_gateway     = true
  single_nat_gateway     = local.cfg.single_nat
  one_nat_gateway_per_az = !local.cfg.single_nat

  public_subnet_tags  = { "kubernetes.io/role/elb" = 1 }
  private_subnet_tags = { "kubernetes.io/role/internal-elb" = 1 }
}

resource "aws_vpc_endpoint" "s3" {
  vpc_id            = module.vpc.vpc_id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = module.vpc.private_route_table_ids
}

module "kms" {
  source  = "terraform-aws-modules/kms/aws"
  version = "4.2.2"

  description = "${local.name}: Secrets Manager, RDS, EFS and ElastiCache"
  aliases     = ["pocketcoffee/${local.env}"]

  enable_key_rotation = true
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "21.29.0"

  name               = local.name
  kubernetes_version = local.cfg.kubernetes_version

  vpc_id                   = module.vpc.vpc_id
  subnet_ids               = module.vpc.private_subnets
  control_plane_subnet_ids = module.vpc.private_subnets

  endpoint_public_access       = true
  endpoint_public_access_cidrs = var.admin_cidrs
  endpoint_private_access      = true

  enable_cluster_creator_admin_permissions = true

  compute_config = {
    enabled    = true
    node_pools = ["general-purpose"]
  }

  addons = {
    eks-pod-identity-agent = {
      before_compute = true
    }
    aws-efs-csi-driver = {
      pod_identity_association = [{
        role_arn        = aws_iam_role.efs_csi.arn
        service_account = "efs-csi-controller-sa"
      }]
    }
  }
}

data "aws_iam_policy_document" "pods_trust" {
  statement {
    actions = ["sts:AssumeRole", "sts:TagSession"]
    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "efs_csi" {
  name               = "${local.name}-efs-csi"
  assume_role_policy = data.aws_iam_policy_document.pods_trust.json
}

resource "aws_iam_role_policy_attachment" "efs_csi" {
  role       = aws_iam_role.efs_csi.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
}

# External Secrets Operator: read only the secrets of this environment.
data "aws_iam_policy_document" "external_secrets" {
  statement {
    actions   = ["secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret"]
    resources = ["arn:aws:secretsmanager:${var.region}:${data.aws_caller_identity.current.account_id}:secret:${local.secret_prefix}/*"]
  }
  statement {
    actions   = ["kms:Decrypt"]
    resources = [module.kms.key_arn]
  }
}

resource "aws_iam_role" "external_secrets" {
  name               = "${local.name}-external-secrets"
  assume_role_policy = data.aws_iam_policy_document.pods_trust.json
}

resource "aws_iam_role_policy" "external_secrets" {
  role   = aws_iam_role.external_secrets.id
  policy = data.aws_iam_policy_document.external_secrets.json
}

resource "aws_eks_pod_identity_association" "external_secrets" {
  cluster_name    = module.eks.cluster_name
  namespace       = "external-secrets"
  service_account = "external-secrets"
  role_arn        = aws_iam_role.external_secrets.arn
}

resource "aws_security_group" "db" {
  name_prefix = "${local.name}-db-"
  description = "MySQL from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "db_from_cluster" {
  security_group_id            = aws_security_group.db.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 3306
  to_port                      = 3306
  ip_protocol                  = "tcp"
  description                  = "MySQL from pods on EKS nodes"
}

module "db" {
  source  = "terraform-aws-modules/rds/aws"
  version = "7.2.2"

  identifier = local.name

  engine               = "mysql"
  engine_version       = "8.4"
  family               = "mysql8.4"
  major_engine_version = "8.4"
  instance_class       = local.cfg.db_instance_class

  allocated_storage     = local.cfg.db_allocated_gb
  max_allocated_storage = local.cfg.db_allocated_gb * 4
  storage_type          = "gp3"
  storage_encrypted     = true
  kms_key_id            = module.kms.key_arn

  db_name  = "pocketcoffee"
  username = "ps_admin"
  port     = 3306

  # RDS creates and rotates the master password in Secrets Manager. The users
  # ps_app and ps_migrate are created by the bootstrap script.
  manage_master_user_password   = true
  master_user_secret_kms_key_id = module.kms.key_arn

  multi_az               = local.cfg.db_multi_az
  db_subnet_group_name   = module.vpc.database_subnet_group_name
  vpc_security_group_ids = [aws_security_group.db.id]
  publicly_accessible    = false

  backup_retention_period = 14
  backup_window           = "02:00-03:00"
  maintenance_window      = "Mon:03:30-Mon:04:30"
  copy_tags_to_snapshot   = true
  deletion_protection     = local.cfg.db_deletion_protect
  skip_final_snapshot     = !local.cfg.db_deletion_protect

  auto_minor_version_upgrade      = true
  enabled_cloudwatch_logs_exports = ["error", "slowquery"]

  parameters = [
    { name = "character_set_server", value = "utf8mb4" },
    { name = "collation_server", value = "utf8mb4_general_ci" },
    { name = "max_allowed_packet", value = "67108864" },
    { name = "slow_query_log", value = "1" },
    { name = "long_query_time", value = "1" },
    { name = "max_connections", value = "400", apply_method = "pending-reboot" },
  ]
}

resource "aws_security_group" "efs" {
  name_prefix = "${local.name}-efs-"
  description = "NFS from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "efs_from_cluster" {
  security_group_id            = aws_security_group.efs.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 2049
  to_port                      = 2049
  ip_protocol                  = "tcp"
  description                  = "NFS from pods on EKS nodes"
}

module "efs" {
  source  = "terraform-aws-modules/efs/aws"
  version = "2.2.1"

  name        = "${local.name}-shared"
  encrypted   = true
  kms_key_arn = module.kms.key_arn

  performance_mode = "generalPurpose"
  throughput_mode  = "elastic"

  mount_targets = {
    for i, subnet_id in module.vpc.private_subnets : "az${i}" => {
      subnet_id       = subnet_id
      security_groups = [aws_security_group.efs.id]
    }
  }

  # img/, upload/ and download/ live below /shared; every client is UID/GID 33 (www-data).
  access_points = {
    shared = {
      name = "shared"
      posix_user = {
        uid = 33
        gid = 33
      }
      root_directory = {
        path = "/shared"
        creation_info = {
          owner_uid   = 33
          owner_gid   = 33
          permissions = "0755"
        }
      }
    }
  }

  enable_backup_policy = true
}

resource "aws_security_group" "cache" {
  name_prefix = "${local.name}-cache-"
  description = "Valkey and Memcached from the cluster nodes"
  vpc_id      = module.vpc.vpc_id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_vpc_security_group_ingress_rule" "valkey_from_cluster" {
  security_group_id            = aws_security_group.cache.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 6379
  to_port                      = 6379
  ip_protocol                  = "tcp"
  description                  = "Valkey (TLS) from pods on EKS nodes"
}

resource "aws_vpc_security_group_ingress_rule" "memcached_from_cluster" {
  security_group_id            = aws_security_group.cache.id
  referenced_security_group_id = module.eks.cluster_primary_security_group_id
  from_port                    = 11211
  to_port                      = 11211
  ip_protocol                  = "tcp"
  description                  = "Memcached from pods on EKS nodes"
}

# AUTH token. It lands in the (encrypted) state; see the WordPress infrastructure page.
resource "random_password" "valkey" {
  length  = 48
  special = false
}

# Sessions: cluster mode disabled, one primary and replicas, TLS and AUTH.
resource "aws_elasticache_replication_group" "valkey" {
  replication_group_id = "${local.name}-valkey"
  description          = "PHP sessions for ${local.name}"

  engine         = "valkey"
  engine_version = "9.0"
  node_type      = local.cfg.valkey_node_type
  port           = 6379

  num_cache_clusters         = local.cfg.valkey_replicas + 1
  automatic_failover_enabled = true
  multi_az_enabled           = true

  subnet_group_name  = module.vpc.elasticache_subnet_group_name
  security_group_ids = [aws_security_group.cache.id]

  at_rest_encryption_enabled = true
  kms_key_id                 = module.kms.key_arn
  transit_encryption_enabled = true
  auth_token                 = random_password.valkey.result

  # Sessions must not be evicted to make room: a full cache refuses writes instead.
  parameter_group_name = aws_elasticache_parameter_group.valkey.name

  snapshot_retention_limit = 0
}

resource "aws_elasticache_parameter_group" "valkey" {
  name        = "${local.name}-valkey9"
  family      = "valkey9"
  description = "PrestaShop PHP sessions"

  parameter {
    name  = "maxmemory-policy"
    value = "noeviction"
  }
}

# SQL cache of the shop (CacheMemcached). Memcached has no replication: a node
# loss empties its share of the cache, which PrestaShop rebuilds from the database.
resource "aws_elasticache_cluster" "memcached" {
  cluster_id           = "${local.name}-memcached"
  engine               = "memcached"
  engine_version       = "1.6.22"
  node_type            = local.cfg.memcached_node_type
  num_cache_nodes      = local.cfg.memcached_nodes
  az_mode              = local.cfg.memcached_nodes > 1 ? "cross-az" : "single-az"
  port                 = 11211
  parameter_group_name = "default.memcached1.6"
  subnet_group_name    = module.vpc.elasticache_subnet_group_name
  security_group_ids   = [aws_security_group.cache.id]
}

module "ecr" {
  source  = "terraform-aws-modules/ecr/aws"
  version = "3.2.1"

  # Created in the production workspace only; staging pulls from the same repository.
  create = terraform.workspace == "production"

  repository_name                 = "pocketcoffee/prestashop"
  repository_image_tag_mutability = "IMMUTABLE"
  repository_image_scan_on_push   = true

  repository_lifecycle_policy = jsonencode({
    rules = [{
      rulePriority = 1
      description  = "Keep the last 60 tags"
      selection = {
        tagStatus   = "any"
        countType   = "imageCountMoreThan"
        countNumber = 60
      }
      action = { type = "expire" }
    }]
  })
}

resource "aws_iam_openid_connect_provider" "github" {
  count = terraform.workspace == "production" ? 1 : 0

  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]
}

data "aws_iam_policy_document" "github_trust" {
  count = terraform.workspace == "production" ? 1 : 0

  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github[0].arn]
    }
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:${var.github_repository}:ref:refs/heads/main"]
    }
  }
}

resource "aws_iam_role" "github_ecr_push" {
  count = terraform.workspace == "production" ? 1 : 0

  name               = "pocketcoffee-github-ecr-push"
  assume_role_policy = data.aws_iam_policy_document.github_trust[0].json
}

data "aws_iam_policy_document" "ecr_push" {
  count = terraform.workspace == "production" ? 1 : 0

  statement {
    actions   = ["ecr:GetAuthorizationToken"]
    resources = ["*"]
  }
  statement {
    actions = [
      "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart",
      "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer",
    ]
    resources = [module.ecr.repository_arn]
  }
}

resource "aws_iam_role_policy" "ecr_push" {
  count = terraform.workspace == "production" ? 1 : 0

  role   = aws_iam_role.github_ecr_push[0].id
  policy = data.aws_iam_policy_document.ecr_push[0].json
}

# Containers only for the shop secrets: scripts/seed-secrets.sh writes the values, so
# cookie keys and passwords never appear in the configuration or in a plan.
resource "aws_secretsmanager_secret" "prestashop" {
  name        = "${local.secret_prefix}/prestashop"
  description = "secret, cookie_key, cookie_iv, new_cookie_key, Admin API keys"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

# One secret per database user, in the shape of a database credential (username, password,
# engine, host, port, dbname) that the rotation functions and RDS Proxy expect.
resource "aws_secretsmanager_secret" "db_app" {
  name        = "${local.secret_prefix}/prestashop-db-app"
  description = "Database credential of ps_app: the web pods and the cron"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

resource "aws_secretsmanager_secret" "db_migrate" {
  name        = "${local.secret_prefix}/prestashop-db-migrate"
  description = "Database credential of ps_migrate: the install and migrate Jobs"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

resource "aws_secretsmanager_secret" "valkey" {
  name        = "${local.secret_prefix}/valkey"
  description = "Endpoint and AUTH token of the session store"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

resource "aws_secretsmanager_secret_version" "valkey" {
  secret_id = aws_secretsmanager_secret.valkey.id
  secret_string = jsonencode({
    VALKEY_HOST = aws_elasticache_replication_group.valkey.primary_endpoint_address
    VALKEY_AUTH = random_password.valkey.result
    VALKEY_PORT = "6379"
  })
}

# The first administrator password, read once by the install Job; delete it afterwards.
resource "aws_secretsmanager_secret" "install" {
  name        = "${local.secret_prefix}/prestashop-install"
  description = "ADMIN_PASSWORD for the first install"
  kms_key_id  = module.kms.key_arn

  recovery_window_in_days = local.env == "prod" ? 30 : 0
}

data "aws_route53_zone" "root" {
  name         = var.root_domain
  private_zone = false
}

# Regional certificate for the load balancer. The apex redirects to www in production.
resource "aws_acm_certificate" "site" {
  domain_name               = local.cfg.site_host
  validation_method         = "DNS"
  subject_alternative_names = local.env == "prod" ? [var.root_domain] : []

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "site_validation" {
  for_each = {
    for o in aws_acm_certificate.site.domain_validation_options : o.domain_name => {
      name   = o.resource_record_name
      type   = o.resource_record_type
      record = o.resource_record_value
    }
  }

  zone_id         = data.aws_route53_zone.root.zone_id
  name            = each.value.name
  type            = each.value.type
  records         = [each.value.record]
  ttl             = 60
  allow_overwrite = true
}

resource "aws_acm_certificate_validation" "site" {
  certificate_arn         = aws_acm_certificate.site.arn
  validation_record_fqdns = [for r in aws_route53_record.site_validation : r.fqdn]
}

locals {
  waf_rules = [
    { name = "AWSManagedRulesCommonRuleSet", priority = 10 },
    { name = "AWSManagedRulesKnownBadInputsRuleSet", priority = 20 },
    { name = "AWSManagedRulesSQLiRuleSet", priority = 30 },
    { name = "AWSManagedRulesPHPRuleSet", priority = 40 },
  ]
}

resource "aws_wafv2_ip_set" "admin" {
  name               = "${local.name}-admin"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  addresses          = var.admin_cidrs
}

# Regional web ACL, attached to the load balancer.
resource "aws_wafv2_web_acl" "alb" {
  name  = "${local.name}-alb"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  # The renamed back office answers only to the office and VPN addresses.
  rule {
    name     = "admin-allow-list"
    priority = 1

    action {
      block {}
    }

    statement {
      and_statement {
        statement {
          byte_match_statement {
            search_string         = "/${var.admin_dir}/"
            positional_constraint = "STARTS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "LOWERCASE"
            }
          }
        }
        statement {
          not_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.admin.arn
              }
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "admin-allow-list"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "login-rate-limit"
    priority = 2

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 100
        aggregate_key_type = "IP"
        scope_down_statement {
          byte_match_statement {
            search_string         = "/login"
            positional_constraint = "STARTS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "NONE"
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "login-rate-limit"
      sampled_requests_enabled   = true
    }
  }

  dynamic "rule" {
    for_each = local.waf_rules
    content {
      name     = rule.value.name
      priority = rule.value.priority

      override_action {
        none {}
      }

      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = "AWS"
        }
      }

      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = rule.value.name
        sampled_requests_enabled   = true
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${local.name}-alb"
    sampled_requests_enabled   = true
  }
}

output "cluster_name" {
  value = module.eks.cluster_name
}

output "db_endpoint" {
  description = "Goes into the Helm value database.host."
  value       = module.db.db_instance_address
}

output "db_master_secret_arn" {
  value = module.db.db_instance_master_user_secret_arn
}

output "efs_file_system_id" {
  description = "Goes into the Helm value shared.efs.fileSystemId."
  value       = module.efs.id
}

output "efs_access_point_id" {
  description = "Goes into the Helm value shared.efs.accessPointId."
  value       = module.efs.access_points["shared"].id
}

output "valkey_primary_endpoint" {
  value = aws_elasticache_replication_group.valkey.primary_endpoint_address
}

output "memcached_endpoint" {
  description = "Goes into ps_memcached_servers (see the cache page)."
  value       = aws_elasticache_cluster.memcached.cluster_address
}

output "site_certificate_arn" {
  value = aws_acm_certificate_validation.site.certificate_arn
}

output "waf_acl_arn" {
  value = aws_wafv2_web_acl.alb.arn
}

output "ecr_repository_url" {
  value = module.ecr.repository_url
}

cd infra
tofu init -backend-config="bucket=pocketcoffee-tfstate-123456789012"
tofu workspace select -or-create staging
tofu plan -out=staging.plan
tofu apply staging.plan

# Offline check, without credentials or a backend (one workspace at a time):
tofu init -backend=false
tofu fmt -check
TF_WORKSPACE=staging tofu validate
TF_WORKSPACE=production tofu validate

# nginx container of the pod; PHP-FPM listens on 127.0.0.1:9000 in the same pod.
set_real_ip_from {{ .Values.shop.trustedProxies }};
real_ip_header X-Forwarded-For;
real_ip_recursive on;

server {
    listen 8080 default_server;
    server_name _;
    root /var/www/html;
    index index.php;
    client_max_body_size 16M;
    server_tokens off;
    error_page 404 /index.php?controller=404;

    # Liveness: answered by nginx itself. Readiness: PHP-FPM's own ping; no PHP code, no database.
    location = /healthz { access_log off; default_type text/plain; return 200 "ok\n"; }
    location = /readyz {
        access_log off;
        fastcgi_param REQUEST_METHOD GET;
        fastcgi_param SCRIPT_NAME /fpm-ping;
        fastcgi_param SCRIPT_FILENAME /fpm-ping;
        fastcgi_pass 127.0.0.1:9000;
    }

    rewrite ^/(\d)(-[\w-]+)?/.+\.(jpe?g|png|webp|avif)$ /img/p/$1/$1$2.$3 last;
    rewrite ^/(\d)(\d)(-[\w-]+)?/.+\.(jpe?g|png|webp|avif)$ /img/p/$1/$2/$1$2$3.$4 last;
    rewrite ^/c/([\w.-]+)/.+\.(jpe?g|png|webp|avif)$ /img/c/$1.$2 last;
    rewrite ^/api/?(.*)$ /webservice/dispatcher.php?url=$1 last;

    location / { try_files $uri $uri/ /index.php$is_args$args; }
    location /{{ .Values.shop.adminDir }}/ {
        try_files $uri $uri/ /{{ .Values.shop.adminDir }}/index.php$is_args$args;
    }

    location ~ /\.(?!well-known) { deny all; }
    location ~ ^/(app|bin|cache|classes|config|controllers|docs|localization|override|src|tests|tools|translations|var|vendor)/ { deny all; }
    location ~ ^/modules/.*/vendor/ { deny all; }
    location ~ \.(log|tpl|twig|sass|yml)$ { deny all; }
    location ~ ^/modules/.*(\.(php|log|txt|lock|json|yml|yaml|tpl|twig)|config\.xml|config_[a-z]+\.xml)$ { deny all; }
    location ~ ^/(composer\.lock|\.git.*|\.env.*)$ { deny all; }
    location /img { location ~ \.php$ { deny all; } }
    location /upload { location ~ \.php$ { deny all; } }

    location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        try_files $fastcgi_script_name =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_index index.php;
        fastcgi_read_timeout 60s;
        fastcgi_pass 127.0.0.1:9000;
    }
}

; Loaded after the image's own pool files, so these values win.
[global]
error_log = /proc/self/fd/2

[www]
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 16
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.max_requests = 500
request_terminate_timeout = 60s
ping.path = /fpm-ping
ping.response = pong
catch_workers_output = yes
decorate_workers_output = no
clear_env = no

; PHP sessions in Valkey. FPM expands ${NAME} from the pod environment.
php_admin_value[session.save_handler] = redis
php_admin_value[session.save_path] = "tls://${VALKEY_HOST}:${VALKEY_PORT}?auth=${VALKEY_AUTH}&prefix=pocketcoffee:sess:&timeout=1.5&read_timeout=2.5&persistent=1"
php_admin_value[redis.session.locking_enabled] = 1
php_admin_value[redis.session.lock_expire] = 30
php_admin_value[redis.session.lock_wait_time] = 20000
php_admin_value[redis.session.lock_retries] = 500

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-env
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  DB_SERVER: {{ required "set database.host" .Values.database.host | quote }}
  DB_PORT: {{ .Values.database.port | quote }}
  DB_NAME: {{ .Values.database.name | quote }}
  DB_PREFIX: {{ .Values.database.prefix | quote }}
  PS_DOMAIN: {{ .Values.shop.domain | quote }}
  PS_LOCALE: {{ .Values.shop.locale | quote }}
  PS_CREATION_DATE: {{ .Values.shop.creationDate | quote }}
  PS_CACHE_ENABLE: {{ ternary "1" "0" .Values.shop.cacheEnabled | quote }}
  PS_TRUSTED_PROXIES: {{ .Values.shop.trustedProxies | quote }}
  SYMFONY_ENV: prod
  VALKEY_PORT: "6379"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ .Release.Name }}-config
  labels:
    {{- include "pc.labels" . | nindent 4 }}
data:
  default.conf: |
    {{- tpl (.Files.Get "files/default.conf") . | nindent 4 }}
  php-fpm.conf: |
    {{- .Files.Get "files/php-fpm.conf" | nindent 4 }}

{{- if .Values.secrets.enabled }}
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ .Release.Name }}-secrets
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.secrets.refreshInterval }}
  secretStoreRef:
    kind: ClusterSecretStore
    name: {{ .Values.secrets.storeName }}
  target:
    name: {{ .Release.Name }}-secrets
    creationPolicy: Owner
  # One Kubernetes Secret. The password of each database credential gets its own key;
  # every JSON key of the shop and Valkey secrets (PS_SECRET, PS_COOKIE_KEY, ...,
  # VALKEY_HOST, VALKEY_AUTH, VALKEY_PORT) becomes a key under its own name.
  data:
    - secretKey: DB_PASSWORD_APP
      remoteRef:
        key: {{ .Values.secrets.dbAppName }}
        property: password
    - secretKey: DB_PASSWORD_MIGRATE
      remoteRef:
        key: {{ .Values.secrets.dbMigrateName }}
        property: password
  dataFrom:
    - extract:
        key: {{ .Values.secrets.name }}
    - extract:
        key: {{ .Values.secrets.valkeyName }}
{{- if .Values.install.enabled }}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ .Release.Name }}-install
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.secrets.refreshInterval }}
  secretStoreRef:
    kind: ClusterSecretStore
    name: {{ .Values.secrets.storeName }}
  target:
    name: {{ .Release.Name }}-install
    creationPolicy: Owner
  dataFrom:
    - extract:
        key: {{ .Values.secrets.installName }}
{{- end }}
{{- end }}

# Static provisioning: the PV names the EFS access point from OpenTofu (UID/GID 33).
apiVersion: v1
kind: PersistentVolume
metadata:
  name: {{ .Release.Namespace }}-{{ .Values.shared.claimName }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  capacity:
    storage: {{ .Values.shared.size }}
  accessModes: [ReadWriteMany]
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ""
  csi:
    driver: efs.csi.aws.com
    volumeHandle: {{ required "set shared.efs.fileSystemId" .Values.shared.efs.fileSystemId }}::{{ required "set shared.efs.accessPointId" .Values.shared.efs.accessPointId }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ .Values.shared.claimName }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  accessModes: [ReadWriteMany]
  storageClassName: ""
  volumeName: {{ .Release.Namespace }}-{{ .Values.shared.claimName }}
  resources:
    requests:
      storage: {{ .Values.shared.size }}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
    app.kubernetes.io/component: web
spec:
  {{- if .Values.install.enabled }}
  replicas: 0   # no web pod while the installer runs
  {{- else if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.web.replicas }}
  {{- end }}
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0
  selector:
    matchLabels:
      {{- include "pc.selector" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "pc.selector" . | nindent 8 }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
    spec:
      serviceAccountName: {{ .Release.Name }}-prestashop
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: {{ .Values.web.terminationGracePeriodSeconds }}
      securityContext:
        runAsNonRoot: true
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              {{- include "pc.selector" . | nindent 14 }}
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              {{- include "pc.selector" . | nindent 14 }}
      initContainers:
        # The compiled Symfony container embeds the parameters it was built with, so the
        # per-pod cache is built here, with this pod's real environment.
        - name: warmup
          image: {{ include "pc.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          command: ["sh", "-c"]
          args:
            - |
              set -e
              for app in admin front; do
                php bin/console cache:warmup --env=prod --app-id="$app"
              done
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.appUser "key" "DB_PASSWORD_APP") | nindent 12 }}
          resources:
            requests: { cpu: 500m, memory: 768Mi }
            limits: { memory: 1Gi }
          volumeMounts:
            {{- include "pc.codeMounts" . | nindent 12 }}
      containers:
        - name: php-fpm
          image: {{ include "pc.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          ports:
            - name: fastcgi
              containerPort: 9000
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.appUser "key" "DB_PASSWORD_APP") | nindent 12 }}
          livenessProbe:
            tcpSocket:
              port: fastcgi
            periodSeconds: 10
            failureThreshold: 3
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "10"]
          resources:
            {{- toYaml .Values.web.phpFpm.resources | nindent 12 }}
          volumeMounts:
            {{- include "pc.codeMounts" . | nindent 12 }}
            - name: config
              mountPath: /usr/local/etc/php-fpm.d/zz-pocketcoffee.conf
              subPath: php-fpm.conf
        - name: nginx
          image: {{ include "pc.nginxImage" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 101
            runAsGroup: 101
          ports:
            - name: http
              containerPort: 8080
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 2
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "10"]
          resources:
            {{- toYaml .Values.web.nginx.resources | nindent 12 }}
          volumeMounts:
            - { name: nginx-tmp, mountPath: /tmp }
            - name: config
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
            {{- range .Values.shared.mounts }}
            {{- if .nginx }}
            - { name: shared, mountPath: /var/www/html/{{ .path }}, subPath: {{ .subPath }}, readOnly: true }
            {{- end }}
            {{- end }}
      volumes:
        {{- include "pc.volumes" . | nindent 8 }}
        - { name: nginx-tmp, emptyDir: { sizeLimit: 128Mi } }
        - name: config
          configMap:
            name: {{ .Release.Name }}-config

apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    {{- include "pc.selector" . | nindent 4 }}
  ports:
    - name: http
      port: 80
      targetPort: http

{{- if .Values.httpRoute.enabled }}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  parentRefs:
    - name: {{ .Values.httpRoute.parentRef.name }}
      namespace: {{ .Values.httpRoute.parentRef.namespace }}
  hostnames:
    - {{ .Values.shop.domain }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-web
          port: 80
{{- if .Values.httpRoute.redirectApex }}
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-apex
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  parentRefs:
    - name: {{ .Values.httpRoute.parentRef.name }}
      namespace: {{ .Values.httpRoute.parentRef.namespace }}
  hostnames:
    - {{ .Values.httpRoute.apexHost }}
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            hostname: {{ .Values.shop.domain }}
            statusCode: 301
{{- end }}
{{- end }}

{{- if and .Values.autoscaling.enabled (not .Values.install.enabled) }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ .Release.Name }}-web
  minReplicas: {{ .Values.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
---
{{- end }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ .Release.Name }}-web
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
  selector:
    matchLabels:
      {{- include "pc.selector" . | nindent 6 }}

{{- if .Values.cron.enabled }}
apiVersion: batch/v1
kind: CronJob
metadata:
  name: {{ .Release.Name }}-cron
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  schedule: {{ .Values.cron.schedule | quote }}
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 120
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 290
      ttlSecondsAfterFinished: 3600
      template:
        metadata:
          labels:
            app.kubernetes.io/name: {{ include "pc.name" . }}
            app.kubernetes.io/instance: {{ .Release.Name }}
            app.kubernetes.io/component: cron
        spec:
          restartPolicy: Never
          serviceAccountName: {{ .Release.Name }}-prestashop
          automountServiceAccountToken: false
          securityContext:
            runAsNonRoot: true
            fsGroup: 33
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: cron
              image: {{ include "pc.image" . }}
              securityContext:
                {{- include "pc.containerSecurity" . | nindent 16 }}
                runAsUser: 33
                runAsGroup: 33
              command: ["sh", "-c"]
              args:
                - |
                  set -e
                  cd /var/www/html
                  {{- range .Values.cron.commands }}
                  {{ . }}
                  {{- end }}
              envFrom:
                {{- include "pc.envFrom" . | nindent 16 }}
              env:
                {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.appUser "key" "DB_PASSWORD_APP") | nindent 16 }}
              resources:
                requests: { cpu: 200m, memory: 512Mi }
                limits: { memory: 1Gi }
              volumeMounts:
                {{- include "pc.codeMounts" . | nindent 16 }}
          volumes:
            {{- include "pc.volumes" . | nindent 12 }}
{{- end }}

{{- if .Values.migrate.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-migrate
  labels:
    {{- include "pc.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 900
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "pc.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: migrate
    spec:
      restartPolicy: Never
      serviceAccountName: {{ .Release.Name }}-prestashop
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: upgrade-modules
          image: {{ include "pc.image" . }}
          securityContext:
            {{- include "pc.containerSecurity" . | nindent 12 }}
            runAsUser: 33
            runAsGroup: 33
          command: ["sh", "-c"]
          args:
            - |
              set -e
              cd /var/www/html
              {{- range .Values.migrate.modules }}
              php bin/console prestashop:module upgrade {{ . }} --env=prod
              {{- end }}
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "DB_PASSWORD_MIGRATE") | nindent 12 }}
          resources:
            requests: { cpu: 200m, memory: 512Mi }
            limits: { memory: 1Gi }
          volumeMounts:
            {{- include "pc.codeMounts" . | nindent 12 }}
      volumes:
        {{- include "pc.volumes" . | nindent 8 }}
{{- end }}

{{- if .Values.install.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ .Release.Name }}-install
  labels:
    {{- include "pc.labels" . | nindent 4 }}
spec:
  backoffLimit: 0
  activeDeadlineSeconds: 1200
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ include "pc.name" . }}
        app.kubernetes.io/instance: {{ .Release.Name }}
        app.kubernetes.io/component: install
    spec:
      restartPolicy: Never
      serviceAccountName: {{ .Release.Name }}-prestashop
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        fsGroup: 33
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: install
          # The installer image keeps install/ and a writable code tree (see the text).
          image: {{ include "pc.image" . }}{{ .Values.image.installTagSuffix }}
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 33
            runAsGroup: 33
            capabilities:
              drop: [ALL]
          command: ["sh", "-c"]
          args:
            - |
              set -eu
              cd /var/www/html/install
              php index_cli.php \
                --domain="$PS_DOMAIN" --ssl=1 \
                --db_server="$DB_SERVER:$DB_PORT" --db_name="$DB_NAME" \
                --db_user="$DB_USER" --db_password="$DB_PASSWD" --prefix="$DB_PREFIX" \
                --name={{ .Values.shop.name | quote }} \
                --language={{ .Values.install.language }} --country={{ .Values.install.country }} \
                --timezone={{ .Values.install.timezone }} \
                --email={{ .Values.install.adminEmail | quote }} --password="$ADMIN_PASSWORD" \
                --fixtures={{ .Values.install.fixtures | quote }}
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.dbEnv" (dict "root" . "user" .Values.database.migrateUser "key" "DB_PASSWORD_MIGRATE") | nindent 12 }}
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ .Release.Name }}-install
                  key: ADMIN_PASSWORD
          resources:
            requests: { cpu: 500m, memory: 1Gi }
            limits: { memory: 2Gi }
          volumeMounts:
            - { name: tmp, mountPath: /tmp }
            {{- range .Values.shared.mounts }}
            - { name: shared, mountPath: /var/www/html/{{ .path }}, subPath: {{ .subPath }} }
            {{- end }}
      volumes:
        - { name: tmp, emptyDir: { sizeLimit: 256Mi } }
        - name: shared
          persistentVolumeClaim:
            claimName: {{ .Values.shared.claimName }}
{{- end }}

kubectl -n pocketcoffee get pods -o wide
kubectl -n pocketcoffee get httproute
curl -fsS -o /dev/null -w '%{http_code}\n' https://www.pocketcoffee.example/
curl -fsSI https://www.pocketcoffee.example/admin-pocketcoffee/ | head -n 1   # 403 from outside the allow-list
kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- php bin/console prestashop:config get PS_SSL_ENABLED --env=prod
kubectl -n pocketcoffee exec deploy/pocketcoffee-web -c php-fpm -- ls /var/www/html/var/cache/prod