# ddclient — dynamic DNS daemon that keeps dot.nook.family pointing at the home public IP
# Updates Cloudflare A record every 5 minutes; required for DoT (port 853) which can't use Cloudflare proxy

resource "kubernetes_secret" "ddclient_config" {
  metadata {
    name      = "ddclient-config"
    namespace = kubernetes_namespace.dns.metadata[0].name
  }

  data = {
    "ddclient.conf" = <<-EOT
      daemon=300
      syslog=yes
      pid=/var/run/ddclient/ddclient.pid
      use=web, web=https://api.ipify.org

      protocol=cloudflare
      zone=nook.family
      ttl=120
      login=${var.cloudflare_email}
      password=${var.cloudflare_api_key}
      dot.nook.family
    EOT
  }
}

resource "kubernetes_deployment" "ddclient" {
  metadata {
    name      = "ddclient"
    namespace = kubernetes_namespace.dns.metadata[0].name
    labels    = { app = "ddclient" }
  }

  spec {
    replicas = 1
    selector {
      match_labels = { app = "ddclient" }
    }
    template {
      metadata {
        labels = { app = "ddclient" }
      }
      spec {
        container {
          name    = "ddclient"
          image   = "ghcr.io/ddclient/ddclient:latest"
          command = ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]

          volume_mount {
            name       = "config"
            mount_path = "/etc/ddclient/ddclient.conf"
            sub_path   = "ddclient.conf"
            read_only  = true
          }

          resources {
            requests = { memory = "32Mi", cpu = "10m" }
            limits   = { memory = "64Mi" }
          }
        }

        volume {
          name = "config"
          secret {
            secret_name = kubernetes_secret.ddclient_config.metadata[0].name
          }
        }
      }
    }
  }

  depends_on = [kubernetes_namespace.dns]
}