job "postgres" {
  datacenters = ["alo"]

  meta {
    uuid = uuidv4()
  }


  group "db" {
    # Run on primary storage node (zippy) for local disk performance
    constraint {
      attribute = "${meta.storage_role}"
      value     = "primary"
    }

    network {
      port "db" {
        static = 5432
      }
      port "exporter" {
        to = 9187
      }
      port "admin" { }
    }

    task "postgres" {
      driver = "docker"

      config {
        image = "postgis/postgis:15-3.4-alpine"
        ports = ["db"]
        volumes = [ "/data/services/postgres:/var/lib/postgresql/data" ]
      }

      env {
        POSTGRES_PASSWORD = "{{ with nomadVar \"secrets/postgresql\" }}{{ .postgres_password }}{{ end }}"
      }

      service {
        name = "postgres"
        port = "db"
        check {
          type = "tcp"
          port = "db"
          interval = "30s"
          timeout = "2s"
        }
      }

      resources {
        cpu = 1000
        memory = 1024
      }
    }

    task "exporter" {
      driver = "docker"

      config {
        image = "quay.io/prometheuscommunity/postgres-exporter"
        ports = ["exporter"]
      }

      env {
        DATA_SOURCE_NAME = "postgresql://postgres:{{ with nomadVar \"secrets/postgresql\" }}{{ .postgres_password }}{{ end }}@${NOMAD_ADDR_db}/postgres?sslmode=disable"
      }

      service {
        name = "postgres-exporter"
        port = "exporter"
        tags = ["metrics"]
      }
    }

    task "pgadmin" {
      driver = "docker"

      config {
        image = "dpage/pgadmin4:latest"
        ports = ["admin"]
        volumes = [ "/data/services/pgadmin:/var/lib/pgadmin" ]
      }

      env {
        PGADMIN_LISTEN_PORT = "${NOMAD_PORT_admin}"
        PGADMIN_DEFAULT_EMAIL = "${var.default_email}"
        PGADMIN_DEFAULT_PASSWORD = "${var.default_password}"
        PGADMIN_DISABLE_POSTFIX = "True"
        PGADMIN_CONFIG_MAIL_SERVER = "'192.168.1.1'"
        PGADMIN_CONFIG_AUTHENTICATION_SOURCES = "['oauth2', 'internal']"
        PGADMIN_CONFIG_OAUTH2_AUTO_CREATE_USER = "True"
        PGADMIN_CONFIG_OAUTH2_CONFIG = <<EOH
        [{
            'OAUTH2_NAME' : 'pocket-id',
            'OAUTH2_DISPLAY_NAME' : 'SSO',
            'OAUTH2_CLIENT_ID' : '180133da-1bd7-4cde-9c18-2f277e962dab',
            'OAUTH2_CLIENT_SECRET' : 'ELYNAfiWSGYJQUXUDOdpm7tTtyLbrs4E',
            'OAUTH2_TOKEN_URL' : 'https://pocket-id.v.paler.net/api/oidc/token',
            'OAUTH2_AUTHORIZATION_URL' : 'https://pocket-id.v.paler.net/authorize',
            'OAUTH2_API_BASE_URL' : 'https://pocket-id.v.paler.net/',
            'OAUTH2_USERINFO_ENDPOINT' : 'https://pocket-id.v.paler.net/api/oidc/userinfo',
            'OAUTH2_SERVER_METADATA_URL' : 'https://pocket-id.v.paler.net/.well-known/openid-configuration',
            'OAUTH2_SCOPE' : 'openid email profile',
            'OAUTH2_ICON' : 'fa-database',
            'OAUTH2_BUTTON_COLOR' : '#00ff00'
        }]
EOH
      }

      service {
        name = "pgadmin"
        port = "admin"
        tags = [
          "traefik.enable=true",
          "traefik.http.routers.pgadmin.entryPoints=websecure",
        ]
      }
    }
  }
}

variable "default_email" {
  type = string
  default = "petru@paler.net"
}

variable "default_password" {
  type = string
  default = "ahheina6aeki3Hu0aht3"
}