# ── sema-registry 配置中心(可选,各档默认带上;SQLite 落 PVC)──────────────────
{{- if .Values.registry.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: sema-registry-env
  namespace: {{ .Release.Namespace }}
stringData:
  ADMIN_BOOTSTRAP_PASSWORD: {{ required "registry.adminPassword is required (registry.enabled=true)" .Values.registry.adminPassword | quote }}
  SESSION_SECRET: {{ required "registry.sessionSecret is required" .Values.registry.sessionSecret | quote }}
  SERVICE_PULL_TOKEN: {{ required "registry.pullToken is required" .Values.registry.pullToken | quote }}
{{- if .Values.registry.giteaOauthClientSecret }}
  GITEA_OAUTH_CLIENT_SECRET: {{ .Values.registry.giteaOauthClientSecret | quote }}
{{- end }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sema-registry-data
  namespace: {{ .Release.Namespace }}
spec:
  accessModes: [ReadWriteOnce]
{{- if .Values.registry.storageClass }}
  storageClassName: {{ .Values.registry.storageClass }}
{{- end }}
  resources:
    requests:
      storage: {{ .Values.registry.storageSize }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sema-registry
  namespace: {{ .Release.Namespace }}
spec:
  replicas: 1        # SQLite 单写者;要横向扩先迁 CONFIG_STORE=pg
  strategy: { type: Recreate }   # RWO PVC:滚动升级会双 pod 抢卷,Recreate 才换得动
  selector:
    matchLabels: { app: sema-registry }
  template:
    metadata:
      labels: { app: sema-registry }
    spec:
{{- with .Values.imagePullSecrets }}
      imagePullSecrets:
{{- range . }}
        - name: {{ . }}
{{- end }}
{{- end }}
      containers:
        - name: registry
          image: {{ required "registry.image is required (registry.enabled=true)" .Values.registry.image | quote }}
          ports: [{ containerPort: 3000 }]
          env:
            - { name: NODE_ENV, value: production }
            - { name: CONFIG_STORE, value: sqlite }
            - { name: CONFIG_DB_PATH, value: /app/data/config.db }
            - { name: ADMIN_BOOTSTRAP_USER, value: {{ .Values.registry.adminUser | quote }} }
            - { name: ADMIN_BOOTSTRAP_PASSWORD, valueFrom: { secretKeyRef: { name: sema-registry-env, key: ADMIN_BOOTSTRAP_PASSWORD } } }
            - { name: SESSION_SECRET, valueFrom: { secretKeyRef: { name: sema-registry-env, key: SESSION_SECRET } } }
            - { name: SERVICE_PULL_TOKEN, valueFrom: { secretKeyRef: { name: sema-registry-env, key: SERVICE_PULL_TOKEN } } }
{{- if .Values.registry.giteaBaseUrl }}
            - { name: GITEA_BASE_URL, value: {{ .Values.registry.giteaBaseUrl | quote }} }
            - { name: GITEA_OAUTH_CLIENT_ID, value: {{ .Values.registry.giteaOauthClientId | quote }} }
            - { name: GITEA_OAUTH_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: sema-registry-env, key: GITEA_OAUTH_CLIENT_SECRET } } }
{{- end }}
          volumeMounts: [{ name: data, mountPath: /app/data }]
          readinessProbe:
            httpGet: { path: /api/healthz, port: 3000 }
            initialDelaySeconds: 5
            periodSeconds: 5
      volumes:
        - name: data
          persistentVolumeClaim: { claimName: sema-registry-data }
---
apiVersion: v1
kind: Service
metadata:
  name: sema-registry
  namespace: {{ .Release.Namespace }}
spec:
  type: NodePort
  selector: { app: sema-registry }
  ports:
    - port: 3000
      targetPort: 3000
      nodePort: {{ .Values.registry.nodePort }}
{{- end }}