# Package registries — Verdaccio (npm) and devpi (PyPI)
# Both proxy to public registries and cache locally on Legion

resource "kubernetes_namespace" "packages" {
  metadata {
    name = "packages"
    labels = {
      managed-by = "terraform"
      tier       = "infrastructure"
    }
  }
}

resource "kubernetes_persistent_volume_claim" "verdaccio_data" {
  metadata {
    name      = "verdaccio-data"
    namespace = kubernetes_namespace.packages.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = { storage = "10Gi" }
    }
  }
}

resource "kubernetes_persistent_volume_claim" "devpi_data" {
  metadata {
    name      = "devpi-data"
    namespace = kubernetes_namespace.packages.metadata[0].name
  }
  spec {
    access_modes = ["ReadWriteOnce"]
    resources {
      requests = { storage = "10Gi" }
    }
  }
}

# Verdaccio — npm proxy/cache
resource "kubernetes_config_map" "verdaccio_config" {
  metadata {
    name      = "verdaccio-config"
    namespace = kubernetes_namespace.packages.metadata[0].name
  }

  data = {
    "config.yaml" = <<-EOT
      storage: /verdaccio/storage
      auth:
        htpasswd:
          file: /verdaccio/storage/htpasswd
          max_users: 1
      uplinks:
        npmjs:
          url: https://registry.npmjs.org/
          cache: true
      packages:
        '@harmonic-framework/*':
          access: $authenticated
          publish: $authenticated
          unpublish: $authenticated
        '**':
          access: $all
          publish: $authenticated
          proxy: npmjs
      listen: 0.0.0.0:4873
      server:
        keepAliveTimeout: 60
      log:
        type: stdout
        format: pretty
        level: http
    EOT
  }
}

# Deployments + Services managed by Argo CD — see servers/legion/apps/packages.yaml