{{- define "mindroom.instanceSecretName" -}}
{{- $instanceSecrets := .instanceSecrets | default (dict) -}}
{{- $instanceSecrets.name | default (printf "mindroom-api-keys-%s" (toString .customer)) -}}
{{- end }}

{{- define "mindroom.instanceSecretsCreate" -}}
{{- $instanceSecrets := .instanceSecrets | default (dict) -}}
{{- $create := true -}}
{{- if hasKey $instanceSecrets "create" -}}
{{- $createValue := lower (toString $instanceSecrets.create) -}}
{{- $create = has $createValue (list "1" "true" "yes" "on") -}}
{{- end -}}
{{- $create -}}
{{- end }}

{{- define "mindroom.instanceSecretHash" -}}
{{- $instanceSecrets := .instanceSecrets | default (dict) -}}
{{- if $instanceSecrets.hash -}}
{{- $instanceSecrets.hash -}}
{{- else -}}
{{- printf "%s|%s|%s|%s|%s|%s|%s|%s|%s|%s" (.openai_key | default "") (.anthropic_key | default "") (.openrouter_key | default "") (.google_key | default "") (.deepseek_key | default "") (.supabaseServiceKey | default "") (.sandbox_proxy_token | default "") (.credentials_encryption_key | default "") (.matrixOidc.clientSecret | default "") (.matrixRegistrationSharedSecret | default .matrix_admin_password | default "") | sha256sum -}}
{{- end -}}
{{- end }}

{{- define "mindroom.workerBackendEnv" -}}
{{- $workerBackend := .workerBackend -}}
{{- $instanceNamespace := .instanceNamespace -}}
{{- $workerImage := .workerImage -}}
{{- $workerImagePullPolicy := .workerImagePullPolicy -}}
{{- $workerServiceAccountName := .workerServiceAccountName -}}
{{- $controlPlaneNodeName := .controlPlaneNodeName -}}
{{- $values := .values -}}
{{- if eq $workerBackend "static_runner" }}
- name: MINDROOM_SANDBOX_PROXY_URL
  value: "http://localhost:8766"
{{- else if eq $workerBackend "kubernetes" }}
- name: MINDROOM_KUBERNETES_WORKER_NAMESPACE
  value: {{ $instanceNamespace | quote }}
- name: MINDROOM_KUBERNETES_WORKER_IMAGE
  value: {{ $workerImage | quote }}
- name: MINDROOM_KUBERNETES_WORKER_IMAGE_PULL_POLICY
  value: {{ $workerImagePullPolicy | quote }}
- name: MINDROOM_KUBERNETES_WORKER_PORT
  value: {{ $values.kubernetesWorkerPort | quote }}
- name: MINDROOM_KUBERNETES_WORKER_SERVICE_ACCOUNT_NAME
  value: {{ $workerServiceAccountName | quote }}
- name: MINDROOM_KUBERNETES_WORKER_STORAGE_PVC_NAME
  value: "mindroom-storage-{{ $values.customer }}"
- name: MINDROOM_KUBERNETES_WORKER_STORAGE_MOUNT_PATH
  value: {{ $values.storagePath | quote }}
- name: MINDROOM_KUBERNETES_WORKER_STORAGE_SUBPATH_PREFIX
  value: {{ $values.kubernetesWorkerStorageSubpathPrefix | quote }}
- name: MINDROOM_KUBERNETES_WORKER_CONFIG_MAP_NAME
  value: "mindroom-config-{{ $values.customer }}"
- name: MINDROOM_KUBERNETES_WORKER_CONFIG_KEY
  value: "config.yaml"
- name: MINDROOM_KUBERNETES_WORKER_CONFIG_PATH
  value: "/app/config.yaml"
{{- if $controlPlaneNodeName }}
- name: MINDROOM_KUBERNETES_WORKER_NODE_NAME
  value: {{ $controlPlaneNodeName | quote }}
{{- end }}
- name: MINDROOM_KUBERNETES_WORKER_IDLE_TIMEOUT_SECONDS
  value: {{ $values.kubernetesWorkerIdleTimeoutSeconds | quote }}
- name: MINDROOM_KUBERNETES_WORKER_READY_TIMEOUT_SECONDS
  value: {{ $values.kubernetesWorkerReadyTimeoutSeconds | quote }}
- name: MINDROOM_KUBERNETES_WORKER_NAME_PREFIX
  value: {{ $values.kubernetesWorkerNamePrefix | quote }}
- name: MINDROOM_KUBERNETES_WORKER_ENABLE_SERVICE_LINKS
  value: {{ $values.kubernetesWorkerEnableServiceLinks | quote }}
- name: MINDROOM_KUBERNETES_WORKER_AUTH_SECRET_NAME
  value: "mindroom-worker-auth-{{ $values.customer }}"
- name: MINDROOM_KUBERNETES_WORKER_LABELS_JSON
  value: {{ dict "customer" $values.customer | toJson | quote }}
- name: MINDROOM_KUBERNETES_WORKER_OWNER_DEPLOYMENT_NAME
  value: "mindroom-{{ $values.customer }}"
{{- end }}
{{- end }}

{{- define "mindroom.staticRunnerContainer" -}}
{{- $values := .values -}}
- name: sandbox-runner
  image: {{ $values.mindroom_image | default "ghcr.io/mindroom-ai/mindroom:latest" }}
  imagePullPolicy: {{ $values.mindroom_image_pull_policy | default "Always" }}
  command: ["tini", "--", "/app/run-sandbox-runner.sh"]
  ports:
  - containerPort: 8766
  env:
  - name: MINDROOM_SANDBOX_RUNNER_MODE
    value: "true"
  - name: MINDROOM_SANDBOX_PROXY_TOKEN
    valueFrom:
      secretKeyRef:
        name: {{ include "mindroom.instanceSecretName" $values }}
        key: sandbox_proxy_token
  - name: MINDROOM_CREDENTIALS_ENCRYPTION_KEY
    valueFrom:
      secretKeyRef:
        name: {{ include "mindroom.instanceSecretName" $values }}
        key: credentials_encryption_key
  - name: MINDROOM_CONFIG_PATH
    value: "/app/config.yaml"
  - name: MINDROOM_STORAGE_PATH
    value: {{ $values.storagePath }}
  - name: HOME
    value: {{ $values.storagePath }}
  volumeMounts:
  - name: config
    mountPath: /app/config.yaml
    subPath: config.yaml
    readOnly: true
  - name: storage
    mountPath: {{ $values.storagePath }}
  - name: sandbox-workspace
    mountPath: /app/workspace
  resources:
    {{- toYaml ($values.sandboxRunnerResources | default (dict)) | nindent 4 }}
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
        - ALL
{{- end }}

{{- define "mindroom.staticRunnerVolume" -}}
- name: sandbox-workspace
  emptyDir: {}
{{- end }}
