#!/usr/bin/env bash
# k8s/storage/bootstrap.sh
# Deploys the MinIO multi-AZ object store into the storage namespace.
#
# Prerequisites:
#   - kubectl configured (KUBECONFIG pointing to cluster-config/kubeconfig)
#   - helm >= 3.x installed
#   - k8s/storage/.env file containing:
#       MINIO_ROOT_USER=...
#       MINIO_ROOT_PASSWORD=...
#     OR those variables already exported in the calling shell.
#
# Idempotent: safe to re-run — helm upgrade --install and kubectl apply are both idempotent.
# Disaster recovery order: run this before k8s/logging/bootstrap.sh (Loki depends on MinIO).
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
KUBECONFIG="${KUBECONFIG:-${SCRIPT_DIR}/../../cluster-config/kubeconfig}"
export KUBECONFIG

# ── Load credentials ──────────────────────────────────────────────────────────
if [[ -f "${SCRIPT_DIR}/.env" ]]; then
  # shellcheck source=/dev/null
  source "${SCRIPT_DIR}/.env"
fi

for var in MINIO_ROOT_USER MINIO_ROOT_PASSWORD; do
  if [[ -z "${!var:-}" ]]; then
    echo "ERROR: ${var} is not set. Export it or place it in k8s/storage/.env"
    exit 1
  fi
done

# ── Namespace ─────────────────────────────────────────────────────────────────
echo "==> Creating storage namespace with privileged pod security..."
kubectl create namespace storage --dry-run=client -o yaml | kubectl apply -f -
kubectl label namespace storage \
  pod-security.kubernetes.io/enforce=privileged \
  pod-security.kubernetes.io/enforce-version=latest \
  --overwrite

# ── Helm repos ────────────────────────────────────────────────────────────────
echo "==> Adding Helm repositories..."
helm repo add minio https://charts.min.io
helm repo update minio

# ── PVC for az-a (adopts existing volume) ────────────────────────────────────
echo "==> Applying az-a PVC (adopts pre-existing Longhorn volume)..."
kubectl apply -f "${SCRIPT_DIR}/minio-az-a-pvc.yaml"

# ── MinIO az-a (control-plane node, zone az-a) ───────────────────────────────
echo "==> Installing MinIO az-a..."
helm upgrade --install minio-az-a minio/minio \
  --namespace storage \
  --values "${SCRIPT_DIR}/minio-az-a-values.yaml" \
  --set rootUser="${MINIO_ROOT_USER}" \
  --set rootPassword="${MINIO_ROOT_PASSWORD}" \
  --wait \
  --timeout 5m

echo "==> Waiting for minio-az-a Deployment to be ready..."
kubectl rollout status deployment/minio-az-a -n storage --timeout=120s

# ── MinIO az-b (worker node, zone az-b) ──────────────────────────────────────
echo "==> Installing MinIO az-b..."
helm upgrade --install minio-az-b minio/minio \
  --namespace storage \
  --values "${SCRIPT_DIR}/minio-az-b-values.yaml" \
  --set rootUser="${MINIO_ROOT_USER}" \
  --set rootPassword="${MINIO_ROOT_PASSWORD}" \
  --wait \
  --timeout 5m

echo "==> Waiting for minio-az-b Deployment to be ready..."
kubectl rollout status deployment/minio-az-b -n storage --timeout=120s

# ── Universal frontend service + legacy alias ─────────────────────────────────
echo "==> Applying universal frontend service and legacy ExternalName alias..."
kubectl apply -f "${SCRIPT_DIR}/minio-service.yaml"
kubectl apply -f "${SCRIPT_DIR}/minio-legacy-alias.yaml"

# ── Site replication ──────────────────────────────────────────────────────────
echo "==> Running site replication setup job..."
# Delete any leftover completed job first (kubectl apply on Jobs is not idempotent)
kubectl delete job minio-site-replication-setup -n storage --ignore-not-found
kubectl apply -f "${SCRIPT_DIR}/minio-replication-job.yaml"

echo "==> Waiting for replication job to complete..."
kubectl wait --for=condition=complete job/minio-site-replication-setup \
  -n storage --timeout=120s

echo "==> Replication job output:"
kubectl logs -n storage \
  -l job-name=minio-site-replication-setup \
  --tail=20

# ── Done ──────────────────────────────────────────────────────────────────────
echo ""
echo "==> MinIO multi-AZ stack is up."
echo ""
echo "MinIO console (S3 browser):"
echo "  kubectl port-forward -n storage svc/minio 9001:9001"
echo "  http://localhost:9001  (${MINIO_ROOT_USER} / <your MINIO_ROOT_PASSWORD>)"
echo ""
echo "MinIO S3 endpoint for apps (active-active frontend):"
echo "  http://minio.storage.svc.cluster.local:9000"
echo ""
echo "Verify site replication:"
echo "  kubectl logs -n storage -l job-name=minio-site-replication-setup"