provisioning-catalog/components/mobilizon/cluster/mobilizon-lib.sh

#!/bin/bash
# Methods library for mobilizon — sourced by install-mobilizon.sh and generated run-*.sh scripts.
# SCRIPT_DIR must be set before sourcing.

_kubectl() {
  if command -v kubectl >/dev/null 2>&1; then
    command kubectl "$@"
  elif command -v k0s >/dev/null 2>&1; then
    k0s kubectl "$@"
  else
    echo "ERROR: no kubectl or k0s binary found" >&2; exit 127
  fi
}

_require_env() {
  local var="$1"
  if [ -z "${!var:-}" ]; then
    echo "ERROR: required variable $var is not set" >&2; exit 1
  fi
}

_pod_name() {
  _kubectl get pod \
    --namespace "$MOBILIZON_NAMESPACE" \
    --selector "app.kubernetes.io/name=${MOBILIZON_NAME}" \
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null
}

_wait_for_pod() {
  local timeout="${1:-300}"
  _kubectl wait pod \
    --namespace "$MOBILIZON_NAMESPACE" \
    --selector "app.kubernetes.io/name=${MOBILIZON_NAME}" \
    --for=condition=Ready \
    --timeout="${timeout}s"
}

# Mobilizon uses a dedicated co-deployed PostGIS pod in its own namespace
# (the shared core-data PostgreSQL lacks the PostGIS binaries).
_pg_namespace() { echo "$MOBILIZON_NAMESPACE"; }

_pg_pod() {
  _kubectl get pod --namespace "$(_pg_namespace)" \
    --selector "app.kubernetes.io/name=${MOBILIZON_NAME}-postgis" \
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null
}

_method_wait-postgis() {
  local pg_name="${MOBILIZON_NAME}-postgis"
  echo "  waiting for postgis pod ${pg_name} to be ready..."
  _kubectl wait pod \
    --namespace "$MOBILIZON_NAMESPACE" \
    --selector "app.kubernetes.io/name=${pg_name}" \
    --for=condition=Ready \
    --timeout=180s
  echo "  [ok] postgis ready"
}

# ── Manifest plan helpers ─────────────────────────────────────────────────────

_plan_apply() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl apply -f "$path"
}

_plan_apply_skip() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  if _kubectl get -f "$path" >/dev/null 2>&1; then
    echo "  [skip] ${file} already exists in cluster"
    return 0
  fi
  _kubectl apply -f "$path"
}

_plan_rollout_restart() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl rollout restart -f "$path"
}

_plan_delete() {
  local file="$1"
  local path="$SCRIPT_DIR/manifests/${file}.yaml"
  [ -f "$path" ] || { echo "  [skip] ${file}.yaml not in manifests/"; return 0; }
  _kubectl delete -f "$path" --ignore-not-found
}

# shellcheck source=lib/gateway-tls.sh
source "${SCRIPT_DIR}/lib/gateway-tls.sh"

_method_patch-gateway-https() {
  _lib_gateway_patch_https \
    "${TLS_HOOK_GATEWAY_NAME:-libre-wuji}" \
    "${TLS_HOOK_GATEWAY_NS:-kube-system}" \
    "${TLS_HOOK_LISTENER_NAME}" \
    "${TLS_HOOK_DOMAIN}" \
    "${TLS_HOOK_TLS_SECRET}" \
    "${TLS_HOOK_NAMESPACE}"
}

_method_remove-gateway-https() {
  _lib_gateway_remove_https \
    "${TLS_HOOK_GATEWAY_NAME:-libre-wuji}" \
    "${TLS_HOOK_GATEWAY_NS:-kube-system}" \
    "${TLS_HOOK_LISTENER_NAME}"
}

# ── Component methods ─────────────────────────────────────────────────────────

_method_create-credentials() {
  [ -f "${SCRIPT_DIR}/_credentials.env" ] && set -a && source "${SCRIPT_DIR}/_credentials.env" && set +a
  [ -f "${SCRIPT_DIR}/env-mobilizon" ]    && set -a && source "${SCRIPT_DIR}/env-mobilizon"    && set +a
  _require_env MOBILIZON_DB_PASSWORD
  _require_env MOBILIZON_ADMIN_PASSWORD
  _require_env MOBILIZON_SECRET_KEY_BASE
  _require_env MOBILIZON_GUARDIAN_SECRET

  local db_host="${MOBILIZON_DB_HOST:-${MOBILIZON_NAME}-postgis}"
  local db_port="${MOBILIZON_DB_PORT:-5432}"
  local db_user="${MOBILIZON_DB_USER:-mobilizon}"
  local db_name="${MOBILIZON_DB_NAME:-mobilizon}"

  # Mobilizon reads individual MOBILIZON_DATABASE_* vars; the co-deployed PostGIS
  # reads MOBILIZON_DB_PASSWORD (as POSTGRES_PASSWORD via secretKeyRef).
  _kubectl create secret generic "${MOBILIZON_NAME}-credentials" \
    --namespace "$MOBILIZON_NAMESPACE" \
    --from-literal=MOBILIZON_DB_PASSWORD="$MOBILIZON_DB_PASSWORD" \
    --from-literal=MOBILIZON_DATABASE_HOST="$db_host" \
    --from-literal=MOBILIZON_DATABASE_PORT="$db_port" \
    --from-literal=MOBILIZON_DATABASE_USERNAME="$db_user" \
    --from-literal=MOBILIZON_DATABASE_PASSWORD="$MOBILIZON_DB_PASSWORD" \
    --from-literal=MOBILIZON_DATABASE_DBNAME="$db_name" \
    --from-literal=MOBILIZON_ADMIN_PASSWORD="$MOBILIZON_ADMIN_PASSWORD" \
    --from-literal=MOBILIZON_ADMIN_EMAIL="${MOBILIZON_ADMIN_EMAIL:-}" \
    --from-literal=MOBILIZON_INSTANCE_SECRET_KEY_BASE="$MOBILIZON_SECRET_KEY_BASE" \
    --from-literal=MOBILIZON_INSTANCE_SECRET_KEY="$MOBILIZON_GUARDIAN_SECRET" \
    --dry-run=client -o yaml | _kubectl apply -f -
  echo "  [ok] credentials secret '${MOBILIZON_NAME}-credentials' created in ${MOBILIZON_NAMESPACE}"
}

_method_init-db() {
  [ -f "${SCRIPT_DIR}/_credentials.env" ] && set -a && source "${SCRIPT_DIR}/_credentials.env" && set +a
  [ -f "${SCRIPT_DIR}/env-mobilizon" ]    && set -a && source "${SCRIPT_DIR}/env-mobilizon"    && set +a
  _require_env MOBILIZON_DB_PASSWORD

  local pg_ns pg_pod db_user safe_pw safe_usr safe_db
  pg_ns=$(_pg_namespace)
  pg_pod=$(_pg_pod)
  [ -z "$pg_pod" ] && { echo "  [error] no postgresql pod found in namespace $pg_ns" >&2; exit 1; }

  db_user="${MOBILIZON_DB_USER:-mobilizon}"
  safe_db="${MOBILIZON_DB_NAME:-mobilizon}"

  # The PostGIS container auto-creates the database, role, and password from its
  # POSTGRES_DB / POSTGRES_USER / POSTGRES_PASSWORD env (the role is a superuser).
  # init-db only needs to enable the postgis extension Mobilizon's migrations need.
  _kubectl exec --namespace "$pg_ns" "$pg_pod" -- \
    psql -U "${db_user}" -d "${safe_db}" -c \
    "CREATE EXTENSION IF NOT EXISTS postgis;"
  echo "  [ok] postgis extension enabled in '${safe_db}'"

  _kubectl exec --namespace "$pg_ns" "$pg_pod" -- \
    psql -U "${db_user}" -d "${safe_db}" -c \
    "CREATE EXTENSION IF NOT EXISTS pg_trgm;" 2>/dev/null \
    && echo "  [ok] pg_trgm extension enabled in '${safe_db}'" \
    || echo "  [warn] pg_trgm extension not enabled (continuing)"

  _kubectl exec --namespace "$pg_ns" "$pg_pod" -- \
    psql -U "${db_user}" -d "${safe_db}" -c \
    "CREATE EXTENSION IF NOT EXISTS unaccent;" 2>/dev/null \
    && echo "  [ok] unaccent extension enabled in '${safe_db}'" \
    || echo "  [warn] unaccent extension not enabled (continuing)"
}

_method_wait-ready() {
  _wait_for_pod 300
}

_method_protect-volume() {
  local pvc="${PLAN_PARAM_PVC:-${MOBILIZON_NAME}-uploads}"

  echo "  waiting for PVC '${pvc}' to bind..."
  _kubectl wait pvc "$pvc" \
    --namespace "$MOBILIZON_NAMESPACE" \
    --for=jsonpath='{.status.phase}'=Bound \
    --timeout=120s

  local pv_name
  pv_name=$(_kubectl get pvc "$pvc" \
    --namespace "$MOBILIZON_NAMESPACE" \
    -o jsonpath='{.spec.volumeName}')
  if [ -z "$pv_name" ]; then
    echo "  [warn] could not resolve PV name for PVC '${pvc}' — skipping volume protection"
    return 0
  fi

  if command -v hcloud >/dev/null 2>&1; then
    hcloud volume enable-protection "$pv_name" delete 2>/dev/null \
      && echo "  [ok] volume '${pv_name}' protected" \
      || echo "  [warn] hcloud protect failed — run manually: hcloud volume enable-protection ${pv_name} delete"
  else
    echo "  [warn] hcloud CLI not found — skip volume protection for '${pv_name}'"
  fi
}