---
# One-time job to create the listmonk database and user in the shared postgres.
# Safe to re-run (DO $$ guards prevent duplicate creation).
# Argo CD will re-apply if deleted; ttlSecondsAfterFinished cleans it up automatically.
apiVersion: batch/v1
kind: Job
metadata:
  name: listmonk-db-init
  namespace: listmonk
spec:
  ttlSecondsAfterFinished: 300
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: psql
          image: postgres:16-alpine
          command:
            - sh
            - -c
            - |
              PG_URI="postgresql://postgres:${POSTGRES_PASSWORD}@postgres-postgresql.platform.svc.cluster.local:5432/postgres"
              # Create user if missing
              psql "$PG_URI" -c "DO \$\$ BEGIN
                IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${DB_USER}') THEN
                  EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_USER}', '${DB_PASSWORD}');
                END IF;
              END \$\$;"
              # Create DB if missing
              psql "$PG_URI" -c "SELECT 'CREATE DATABASE ${DB_NAME} OWNER ${DB_USER}'" \
                | grep -q 'CREATE DATABASE' && \
                psql "$PG_URI" -c "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};" || true
              # Ensure privileges
              psql "$PG_URI" -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
              echo "DB init complete."
          env:
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-superuser
                  key: password
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: listmonk-secrets
                  key: db_user
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: listmonk-secrets
                  key: db_password
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: listmonk-secrets
                  key: db_name