1import { configMapWithHash } from '../k8sF/configMapWithHashAI.mts'
2import { secretTemplate } from '../k8sF/k8sSecF.mts'
3import { getS3Cfg } from '../../bktF/serverF/getS3CfgF.mts'
4import type { V1VolumeMount } from '@kubernetes/client-node'
5import type { KubeResource } from '../k8sF/ctxF/klusterCtxF.mts'
6
7// single source of truth for the litestream image pin — bumpable via `updateimg` (scans this file)
8export const litestreamImg = 'litestream/litestream:0.5.15' // 260731
9
10// haS3 mesh bucket that already replicates across clusters (deleteAuthority=harv2demo)
11export const vwLitestreamBucket = 'zatppz-7f18h989329g9i26758hyt50'
12const vwLitestreamPath = 'vaultwarden'
13export const vwDbPath = '/data/db.sqlite3'
14
15export const vwLitestreamCfgName = (name: string) => `${name}-litestream`
16export const vwLitestreamSecName = (name: string) => `${name}-litestream-s3`
17const vwConfigMountPath = '/etc/litestream'
18export const vwLitestreamConfigFile = `${vwConfigMountPath}/litestream.yml`
19
20export const vwLitestreamEnvFrom = (name: string) => [{secretRef: {name: vwLitestreamSecName(name)}}]
21
22// builds the per-cluster ConfigMap (litestream.yml, endpoint = cluster-local haS3 svc) + AWS creds Secret.
23// endpoint is resolved per-cluster via getS3Cfg so traffic stays in-cluster (oryy://lay3kcxr:3472).
24export const vwLitestreamResources = ({name, cluster_name}: {name: string, cluster_name: string}): {
25  configMap: KubeResource, secret: KubeResource, configVolName: string, configMount: V1VolumeMount, configHash: string,
26} => {
27  const {endpoint, accessKeyId, secretAccessKey} = getS3Cfg({bucket_name: vwLitestreamBucket, cluster_name})
28  const litestreamYml = [
29    'dbs:',
30    `  - path: ${vwDbPath}`,
31    '    replica:',
32    '      type: s3',
33    `      bucket: ${vwLitestreamBucket}`,
34    `      path: ${vwLitestreamPath}`,
35    `      endpoint: ${endpoint}`,
36    '      region: us-east-1',
37    '      force-path-style: true',
38    '      sync-interval: 1s',
39  ].join('\n')
40
41  const cfgMapName = vwLitestreamCfgName(name)
42  const {configMap, volume, volumeMount, configHash} = configMapWithHash({name: cfgMapName, data: {'litestream.yml': litestreamYml}, mountPath: vwConfigMountPath})
43  const secret = secretTemplate({name: vwLitestreamSecName(name), secretsH: {AWS_ACCESS_KEY_ID: accessKeyId, AWS_SECRET_ACCESS_KEY: secretAccessKey}})
44  return {configMap, secret, configVolName: volume.name, configMount: volumeMount, configHash}
45}
46