{{- if .Values.server.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "skillhub.fullname" . }}-server
  labels:
    {{- include "skillhub.server.labels" . | nindent 4 }}
spec:
  {{- if not .Values.server.autoscaling.enabled }}
  replicas: {{ .Values.server.replicaCount }}
  {{- end }}
  strategy:
    {{- if and (not .Values.s3.enabled) (ne .Values.server.storage.accessMode "ReadWriteMany") }}
    type: Recreate
    {{- else }}
    type: RollingUpdate
    {{- end }}
  selector:
    matchLabels:
      {{- include "skillhub.server.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "skillhub.server.selectorLabels" . | nindent 8 }}
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
        {{- range $key, $val := .Values.server.podAnnotations }}
        {{ $key }}: {{ $val }}
        {{- end }}
    spec:
      {{- with .Values.server.podSecurityContext }}
      securityContext:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- $secrets := .Values.server.imagePullSecrets }}
      {{- if $secrets }}
      imagePullSecrets:
        {{- toYaml $secrets | nindent 8 }}
      {{- end }}
      initContainers:
        - name: wait-for-dependencies
          image: {{ printf "%s/%s:%s" .Values.server.dependencyWait.image.registry .Values.server.dependencyWait.image.repository .Values.server.dependencyWait.image.tag | quote }}
          imagePullPolicy: {{ .Values.server.dependencyWait.image.pullPolicy }}
          env:
            - name: DB_HOST
              value: {{ include "skillhub.postgresql.serviceName" . | quote }}
            - name: DB_PORT
              value: {{ include "skillhub.postgresql.port" . | quote }}
            - name: REDIS_HOST
              value: {{ include "skillhub.redis.serviceName" . | quote }}
            - name: REDIS_PORT
              value: {{ include "skillhub.redis.port" . | quote }}
          command:
            - sh
            - -c
            - |
              echo "Waiting for PostgreSQL at ${DB_HOST}:${DB_PORT}..."
              until nc -z -w 2 "${DB_HOST}" "${DB_PORT}"; do sleep 2; done
              echo "PostgreSQL is ready!"
              echo "Waiting for Redis at ${REDIS_HOST}:${REDIS_PORT}..."
              until nc -z -w 2 "${REDIS_HOST}" "${REDIS_PORT}"; do sleep 2; done
              echo "Redis is ready!"
      containers:
        - name: server
          image: {{ .Values.server.image.registry | default .Values.images.registry }}/skillhub-server:{{ .Values.server.image.tag | default .Values.images.tag | default (printf "v%s" .Chart.AppVersion) }}
          imagePullPolicy: {{ .Values.images.pullPolicy }}
          ports:
            - containerPort: {{ .Values.server.service.port }}
              name: http
          env:
            - name: SPRING_PROFILES_ACTIVE
              {{- $profiles := .Values.springProfilesActive }}
              {{- if and .Values.redis.enabled .Values.redis.sentinel.enabled }}
              {{- $profiles = printf "%s,redis-sentinel" $profiles }}
              {{- else if and (not .Values.redis.enabled) .Values.externalRedis.sentinel.enabled }}
              {{- $profiles = printf "%s,redis-sentinel" $profiles }}
              {{- end }}
              value: {{ $profiles | quote }}

            # Database
            - name: SPRING_DATASOURCE_URL
              value: {{ include "skillhub.jdbcUrl" . | quote }}
            - name: SPRING_DATASOURCE_USERNAME
              value: {{ include "skillhub.postgresql.username" . | quote }}
            - name: SPRING_DATASOURCE_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.postgresql.enabled }}
                  name: {{ include "skillhub.postgresql.secretName" . }}
                  key: {{ include "skillhub.postgresql.passwordKey" . }}
                  {{- else }}
                  name: {{ include "skillhub.secretName" . }}
                  key: spring-datasource-password
                  {{- end }}

            # Redis
            {{- if and .Values.redis.enabled .Values.redis.sentinel.enabled }}
            - name: SPRING_DATA_REDIS_SENTINEL_MASTER
              value: {{ .Values.redis.sentinel.masterSet | default "mymaster" | quote }}
            - name: SPRING_DATA_REDIS_SENTINEL_NODES
              value: {{ include "skillhub.redis.sentinel.nodes" . | quote }}
            # Bitnami Sentinel pods advertise pod-local addresses that can differ from
            # the headless-service FQDNs used by clients inside Kubernetes.
            - name: SKILLHUB_REDIS_SENTINEL_CHECK_SENTINELS_LIST
              value: "false"
            {{- else if and (not .Values.redis.enabled) .Values.externalRedis.sentinel.enabled }}
            - name: SPRING_DATA_REDIS_SENTINEL_MASTER
              value: {{ .Values.externalRedis.sentinel.masterSet | default "mymaster" | quote }}
            - name: SPRING_DATA_REDIS_SENTINEL_NODES
              value: {{ join "," .Values.externalRedis.sentinel.nodes | quote }}
            {{- else if and (not .Values.redis.enabled) .Values.externalRedis.cluster.enabled }}
            - name: SPRING_DATA_REDIS_CLUSTER_NODES
              value: {{ join "," .Values.externalRedis.cluster.nodes | quote }}
            - name: SPRING_DATA_REDIS_CLUSTER_MAX_REDIRECTS
              value: {{ .Values.externalRedis.cluster.maxRedirects | quote }}
            {{- else }}
            - name: SPRING_DATA_REDIS_HOST
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: redis-host
            - name: SPRING_DATA_REDIS_PORT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: redis-port
            {{- end }}

            {{- if and (not .Values.redis.enabled) .Values.externalRedis.username }}
            - name: SPRING_DATA_REDIS_USERNAME
              value: {{ .Values.externalRedis.username | quote }}
            {{- end }}
            {{- if and (not .Values.redis.enabled) .Values.externalRedis.tls.enabled }}
            - name: SPRING_DATA_REDIS_SSL_ENABLED
              value: "true"
            {{- end }}
            {{- if and (not .Values.redis.enabled) .Values.externalRedis.connectTimeout }}
            - name: SPRING_DATA_REDIS_CONNECT_TIMEOUT
              value: {{ .Values.externalRedis.connectTimeout | quote }}
            {{- end }}
            {{- if and (not .Values.redis.enabled) .Values.externalRedis.timeout }}
            - name: SPRING_DATA_REDIS_TIMEOUT
              value: {{ .Values.externalRedis.timeout | quote }}
            {{- end }}
            {{- if and (not .Values.redis.enabled) .Values.externalRedis.clientName }}
            - name: SPRING_DATA_REDIS_CLIENT_NAME
              value: {{ .Values.externalRedis.clientName | quote }}
            {{- end }}
            {{- if and (not .Values.redis.enabled) .Values.externalRedis.sentinel.enabled .Values.externalRedis.sentinel.username }}
            - name: SPRING_DATA_REDIS_SENTINEL_USERNAME
              value: {{ .Values.externalRedis.sentinel.username | quote }}
            {{- end }}

            {{- if or (and .Values.redis.enabled .Values.redis.sentinel.enabled) (and (not .Values.redis.enabled) .Values.externalRedis.sentinel.enabled) }}
            - name: SPRING_DATA_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.redis.enabled }}
                  name: {{ include "skillhub.redis.secretName" . }}
                  key: {{ include "skillhub.redis.passwordKey" . }}
                  {{- else }}
                  name: {{ include "skillhub.secretName" . }}
                  key: redis-password
                  {{- end }}
                  optional: true
            - name: SPRING_DATA_REDIS_SENTINEL_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.redis.enabled }}
                  name: {{ include "skillhub.redis.secretName" . }}
                  key: {{ include "skillhub.redis.passwordKey" . }}
                  {{- else }}
                  name: {{ include "skillhub.secretName" . }}
                  key: redis-sentinel-password
                  {{- end }}
                  optional: true
            {{- else if or .Values.redis.enabled .Values.externalRedis.password .Values.existingSecret }}
            - name: SPRING_DATA_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.redis.enabled }}
                  name: {{ include "skillhub.redis.secretName" . }}
                  {{- else }}
                  name: {{ include "skillhub.secretName" . }}
                  {{- end }}
                  key: {{ if .Values.redis.enabled }}{{ include "skillhub.redis.passwordKey" . }}{{ else }}redis-password{{ end }}
                  optional: true
            {{- end }}

            # Storage
            - name: STORAGE_BASE_PATH
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: storage-base-path
            - name: SKILLHUB_STORAGE_PROVIDER
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: skillhub-storage-provider

            {{- if .Values.s3.enabled }}
            - name: SKILLHUB_STORAGE_S3_BUCKET
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-bucket
            - name: SKILLHUB_STORAGE_S3_ENDPOINT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-endpoint
            - name: SKILLHUB_STORAGE_S3_PUBLIC_ENDPOINT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-public-endpoint
            - name: SKILLHUB_STORAGE_S3_REGION
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-region
            - name: SKILLHUB_STORAGE_S3_FORCE_PATH_STYLE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-force-path-style
            - name: SKILLHUB_STORAGE_S3_DISABLE_CHUNKED_ENCODING
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-disable-chunked-encoding
            - name: SKILLHUB_STORAGE_S3_AUTO_CREATE_BUCKET
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-auto-create-bucket
            - name: SKILLHUB_STORAGE_S3_PRESIGN_EXPIRY
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: s3-presign-expiry
            - name: SKILLHUB_STORAGE_S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: skillhub-storage-s3-access-key
                  optional: true
            - name: SKILLHUB_STORAGE_S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: skillhub-storage-s3-secret-key
                  optional: true
            {{- end }}

            # Scanner
            - name: SKILLHUB_SECURITY_SCANNER_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: skill-scanner-enabled
            - name: SKILLHUB_SECURITY_SCANNER_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: skill-scanner-url
            - name: SKILLHUB_SECURITY_SCANNER_MODE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: skill-scanner-mode

            # Session
            - name: SESSION_COOKIE_SECURE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: session-cookie-secure
            - name: SPRING_SESSION_REDIS_REPOSITORY_TYPE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: session-repository-type
            - name: SESSION_REDIS_NAMESPACE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: session-redis-namespace
            - name: SPRING_SESSION_REDIS_CONFIGURE_ACTION
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: session-redis-configure-action
            - name: SKILLHUB_AUTH_ACCOUNT_MERGE_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-account-merge-enabled
            - name: SKILLHUB_AUTH_ACCOUNT_MERGE_SESSION_CUTOVER_COMPLETE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-account-merge-session-cutover-complete

            # Public URL and authentication
            - name: SKILLHUB_PUBLIC_BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: public-base-url
            - name: DEVICE_AUTH_VERIFICATION_URI
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: device-auth-verification-uri
            - name: SKILLHUB_AUTH_DIRECT_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-direct-enabled
            {{- if .Values.auth.ldap.enabled }}
            - name: SKILLHUB_AUTH_LDAP_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-enabled
            - name: SKILLHUB_AUTH_LDAP_PROVIDER_CODE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-provider-code
            - name: SKILLHUB_AUTH_LDAP_DISPLAY_NAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-display-name
            - name: SKILLHUB_AUTH_LDAP_AUTHORITY
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-authority
            - name: SKILLHUB_AUTH_LDAP_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-url
            - name: SKILLHUB_AUTH_LDAP_START_TLS
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-start-tls
            - name: SKILLHUB_AUTH_LDAP_DIRECTORY_TYPE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-directory-type
            - name: SKILLHUB_AUTH_LDAP_BASE_DN
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-base-dn
            - name: SKILLHUB_AUTH_LDAP_USER_SEARCH_BASE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-user-search-base
            - name: SKILLHUB_AUTH_LDAP_USER_SEARCH_FILTER
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-user-search-filter
            - name: SKILLHUB_AUTH_LDAP_BIND_DN
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-bind-dn
            - name: SKILLHUB_AUTH_LDAP_BIND_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: ldap-bind-password
            - name: SKILLHUB_AUTH_LDAP_SUBJECT_ATTRIBUTE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-subject-attribute
            - name: SKILLHUB_AUTH_LDAP_SUBJECT_TYPE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-subject-type
            - name: SKILLHUB_AUTH_LDAP_USERNAME_ATTRIBUTE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-username-attribute
            - name: SKILLHUB_AUTH_LDAP_DISPLAY_NAME_ATTRIBUTE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-display-name-attribute
            - name: SKILLHUB_AUTH_LDAP_EMAIL_ATTRIBUTE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-email-attribute
            - name: SKILLHUB_AUTH_LDAP_AVATAR_URL_ATTRIBUTE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-avatar-url-attribute
            - name: SKILLHUB_AUTH_LDAP_EMAIL_AUTHORITATIVE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-email-authoritative
            - name: SKILLHUB_AUTH_LDAP_CONNECT_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-connect-timeout
            - name: SKILLHUB_AUTH_LDAP_READ_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-read-timeout
            - name: SKILLHUB_AUTH_LDAP_POOL_WAIT_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-pool-wait-timeout
            - name: SKILLHUB_AUTH_LDAP_MAX_CONCURRENT_REQUESTS
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-max-concurrent-requests
            - name: SKILLHUB_AUTH_LDAP_MAX_ATTRIBUTE_VALUES
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-ldap-max-attribute-values
            {{- end }}
            - name: SKILLHUB_AUTH_CAS_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-enabled
            - name: SKILLHUB_AUTH_CAS_PROVIDER_CODE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-provider-code
            - name: SKILLHUB_AUTH_CAS_DISPLAY_NAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-display-name
            - name: SKILLHUB_AUTH_CAS_AUTHORITY
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-authority
            - name: SKILLHUB_AUTH_CAS_SERVER_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-server-url
            - name: SKILLHUB_AUTH_CAS_SERVICE_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-service-url
            - name: SKILLHUB_AUTH_CAS_PROTOCOL_VERSION
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-protocol-version
            - name: SKILLHUB_AUTH_CAS_SUBJECT_TYPE
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-subject-type
            - name: SKILLHUB_AUTH_CAS_CONNECT_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-connect-timeout
            - name: SKILLHUB_AUTH_CAS_READ_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-read-timeout
            - name: SKILLHUB_AUTH_CAS_STATE_TTL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-state-ttl
            - name: SKILLHUB_AUTH_CAS_MAX_RESPONSE_BYTES
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-max-response-bytes
            - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_SUBJECT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-attribute-subject
            - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_DISPLAY_NAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-attribute-display-name
            - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_EMAIL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-attribute-email
            - name: SKILLHUB_AUTH_CAS_ATTRIBUTES_AVATAR_URL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-cas-attribute-avatar-url
            - name: SKILLHUB_AUTH_DINGTALK_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-enabled
            - name: OAUTH2_DINGTALK_DISPLAY_NAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-display-name
            - name: SKILLHUB_AUTH_DINGTALK_AUTHORITY
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-authority
            - name: SKILLHUB_AUTH_DINGTALK_CONNECT_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-connect-timeout
            - name: SKILLHUB_AUTH_DINGTALK_READ_TIMEOUT
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-read-timeout
            - name: SKILLHUB_AUTH_DINGTALK_MAX_RESPONSE_BYTES
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: auth-dingtalk-max-response-bytes
            - name: SKILLHUB_BUILTIN_SKILLS_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: builtin-skills-enabled
            - name: SKILLHUB_DOWNLOAD_ANON_COOKIE_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: skillhub-download-anon-cookie-secret

            # Bootstrap Admin
            - name: BOOTSTRAP_ADMIN_ENABLED
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: bootstrap-admin-enabled
            - name: BOOTSTRAP_ADMIN_USER_ID
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: bootstrap-admin-user-id
            - name: BOOTSTRAP_ADMIN_USERNAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: bootstrap-admin-username
            - name: BOOTSTRAP_ADMIN_DISPLAY_NAME
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: bootstrap-admin-display-name
            - name: BOOTSTRAP_ADMIN_EMAIL
              valueFrom:
                configMapKeyRef:
                  name: {{ include "skillhub.fullname" . }}-config
                  key: bootstrap-admin-email
            - name: BOOTSTRAP_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: bootstrap-admin-password
                  optional: true

            # OAuth2 GitHub (optional)
            - name: OAUTH2_GITHUB_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: oauth2-github-client-id
                  optional: true
            - name: OAUTH2_GITHUB_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: oauth2-github-client-secret
                  optional: true
            - name: OAUTH2_DINGTALK_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: oauth2-dingtalk-client-id
                  optional: true
            - name: OAUTH2_DINGTALK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: {{ include "skillhub.secretName" . }}
                  key: oauth2-dingtalk-client-secret
                  optional: true

            {{- if .Values.server.javaOpts }}
            - name: JAVA_OPTS
              value: {{ .Values.server.javaOpts }}
            {{- end }}

            {{- with .Values.server.extraEnv }}
            {{- toYaml . | nindent 12 }}
            {{- end }}

          {{- if and .Values.server.enabled (not .Values.s3.enabled) }}
          volumeMounts:
            - name: skillhub-storage
              mountPath: /var/lib/skillhub/storage
          {{- end }}

          resources:
            {{- toYaml .Values.server.resources | nindent 12 }}

          startupProbe:
            {{- toYaml .Values.server.probes.startup | nindent 12 }}
          readinessProbe:
            {{- toYaml .Values.server.probes.readiness | nindent 12 }}
          livenessProbe:
            {{- toYaml .Values.server.probes.liveness | nindent 12 }}

      {{- if and .Values.server.enabled (not .Values.s3.enabled) }}
      volumes:
        - name: skillhub-storage
          persistentVolumeClaim:
            claimName: {{ include "skillhub.fullname" . }}-server-data
      {{- end }}
      {{- with .Values.server.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.server.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.server.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}

{{- end }}
