---
# One-time setup of a pull-mirror repo in Gitea, pointing at the home
# GitLab GitOps repo. Gitea's own built-in mirror scheduler handles the
# ongoing periodic pulls after this (configured via gitea.config.mirror
# in values.yaml, DEFAULT_INTERVAL: 6h) - this job just creates the
# mirrored repo once, idempotently (skips if it already exists).
#
# GitLab credentials for the mirror source are a plain Secret created
# directly on this cluster (kubectl, not git):
#   kubectl -n gitea create secret generic gitlab-mirror-credentials \
#     --from-literal=username=<gitlab user> --from-literal=password=<PAT>
apiVersion: batch/v1
kind: Job
metadata:
  name: gitea-setup-mirror
  namespace: gitea
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: setup-mirror
          image: curlimages/curl:8.10.1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          command:
            - /bin/sh
            - -c
            - |
              set -eu

              # Service name follows the Helm release name (vps-gitea).
              GITEA_URL="http://vps-gitea-http.gitea.svc.cluster.local:3000"
              REPO_OWNER="gitea_admin"
              REPO_NAME="Homelabv4"

              echo "==> Waiting for Gitea API..."
              for i in $(seq 1 30); do
                if curl -sf "${GITEA_URL}/api/v1/version" >/dev/null 2>&1; then
                  break
                fi
                sleep 5
              done

              echo "==> Checking if mirror repo already exists..."
              EXISTS=$(curl -s -o /dev/null -w '%{http_code}' \
                -u "${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASS}" \
                "${GITEA_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}")

              if [ "$EXISTS" = "200" ]; then
                echo "==> Mirror repo already exists, nothing to do."
                exit 0
              fi

              echo "==> Creating pull-mirror repo from GitLab..."
              curl -sf -X POST \
                -u "${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASS}" \
                -H "Content-Type: application/json" \
                "${GITEA_URL}/api/v1/repos/migrate" \
                -d "{
                  \"clone_addr\": \"https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git\",
                  \"repo_name\": \"${REPO_NAME}\",
                  \"repo_owner\": \"${REPO_OWNER}\",
                  \"mirror\": true,
                  \"mirror_interval\": \"6h\",
                  \"private\": false,
                  \"auth_username\": \"${GITLAB_USER}\",
                  \"auth_password\": \"${GITLAB_TOKEN}\",
                  \"service\": \"gitlab\"
                }"

              echo "==> Done."
          env:
            - name: GITEA_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: gitea-admin-secret
                  key: username
            - name: GITEA_ADMIN_PASS
              valueFrom:
                secretKeyRef:
                  name: gitea-admin-secret
                  key: password
            - name: GITLAB_USER
              valueFrom:
                secretKeyRef:
                  name: gitlab-mirror-credentials
                  key: username
            - name: GITLAB_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitlab-mirror-credentials
                  key: password