# MinIO - Official minio/minio chart, direct Helm deployment (no operator)
# All-in-one: single helm_release + dedicated xfs StorageClass.
# Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
# exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
# no persistence.fsType, so fsType must be set on the StorageClass.

resource "kubernetes_storage_class" "longhorn_xfs" {
  metadata {
    name = "longhorn-xfs"
  }
  storage_provisioner    = "driver.longhorn.io"
  reclaim_policy         = "Delete"
  allow_volume_expansion = true
  volume_binding_mode    = "Immediate"

  parameters = {
    numberOfReplicas   = "2"
    staleReplicaTimeout = "60"
    fsType             = "xfs"
    dataLocality       = "disabled"
  }
}

resource "helm_release" "minio" {
  name            = "minio"
  repository      = "https://charts.min.io/"
  chart           = "minio"
  version         = "5.4.0"
  namespace       = "storage"
  upgrade_install = true
  force_update    = true
  wait            = true
  timeout         = 600

  values = [
    yamlencode({
      mode         = "standalone"
      replicas     = 1
      drivesPerNode = 1
      pools        = 1

      rootUser     = "minioadmin"
      rootPassword = var.minio_root_password

      persistence = {
        enabled      = true
        size         = "100Gi"
        storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
        accessMode   = "ReadWriteOnce"
      }

      resources = {
        requests = {
          memory = "512Mi"
        }
      }

      service = {
        type = "ClusterIP"
        port = "9000"
      }
      consoleService = {
        type = "ClusterIP"
        port = "9001"
      }

      # Buckets auto-created on install (all-in-one, no post-hook needed)
      buckets = [
        { name = "vault", policy = "none", purge = false },
        { name = "riotpiao-models", policy = "none", purge = false },
      ]

      environment = {
        MINIO_IDENTITY_OPENID_CONFIG_URL    = "https://authentik.riotpiao.homelab.com/application/o/minio/.well-known/openid-configuration"
        MINIO_IDENTITY_OPENID_CLIENT_ID     = "minio"
        MINIO_IDENTITY_OPENID_CLIENT_SECRET = var.minio_oidc_client_secret
        MINIO_IDENTITY_OPENID_CLAIM_NAME    = "policy"
        MINIO_IDENTITY_OPENID_SCOPES        = "openid,profile,email,minio"
        MINIO_IDENTITY_OPENID_REDIRECT_URI  = "https://minio.riotpiao.homelab.com/oauth_callback"
        MINIO_IDENTITY_OPENID_DISPLAY_NAME  = "Authentik"
      }
    })
  ]
}

variable "create_storage_namespace" {
  description = "Create storage namespace if it doesn't exist"
  type        = bool
  default     = false
}