# Pose le schéma Guacamole dans la base « guacamole » (storage-01) si absent.
# Hook ArgoCD : recréé à chaque sync, mais le garde-fou (table guacamole_user)
# le rend idempotent — il ne rejoue jamais le schéma sur une base déjà peuplée.
apiVersion: batch/v1
kind: Job
metadata:
  name: guacamole-initdb
  namespace: auth
  annotations:
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 3
  template:
    spec:
      restartPolicy: Never
      initContainers:
        - name: generate-schema
          image: guacamole/guacamole:1.6.0
          command: ["sh", "-c", "/opt/guacamole/bin/initdb.sh --postgresql > /work/initdb.sql"]
          volumeMounts:
            - name: work
              mountPath: /work
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
      containers:
        - name: apply-schema
          image: postgres:16-alpine
          command:
            - sh
            - -c
            - |
              if psql -tAc "SELECT 1 FROM information_schema.tables WHERE table_name='guacamole_user'" | grep -q 1; then
                echo "Schéma déjà présent — rien à faire"
              else
                psql -v ON_ERROR_STOP=1 -f /work/initdb.sql
                echo "Schéma Guacamole appliqué"
              fi
          env:
            - name: PGHOST
              value: "192.168.10.1"
            - name: PGDATABASE
              value: "guacamole"
            - name: PGUSER
              value: "guacamole"
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: guacamole-secret
                  key: pg-password
          volumeMounts:
            - name: work
              mountPath: /work
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
      volumes:
        - name: work
          emptyDir: {}