apiVersion: v1
kind: ConfigMap
metadata:
  name: zot-config
  namespace: {{ taskserv.namespace | default(value="registry") }}
  labels:
    app.kubernetes.io/name: zot
    app.kubernetes.io/managed-by: provisioning
data:
  config.json: |
    {
      "distSpecVersion": "1.1.0",
      "storage": {
        "rootDirectory": "{{ taskserv.data_dir | default(value="/var/lib/data/zot") }}",
        "dedupe": false,
        "gc": true{% if taskserv.storage_backend is defined and taskserv.storage_backend.kind == "s3" %},
        "storageDriver": {
          "name": "s3",
          "rootdirectory": "/zot",
          "region": "{{ taskserv.storage_backend.region | default(value="eu-central-1") }}",{% if taskserv.storage_backend.endpoint is defined and taskserv.storage_backend.endpoint != "" %}
          "regionendpoint": "{{ taskserv.storage_backend.endpoint }}",{% endif %}
          "bucket": "{{ taskserv.storage_backend.bucket | default(value="") }}",
          "secure": true,
          "skipverify": false,
          "forcepathstyle": {{ taskserv.storage_backend.path_style | default(value=true) }}
        }{% endif %}
      },
      "http": {
        "address": "0.0.0.0",
        "port": "{{ taskserv.port | default(value=5000) }}",{% if taskserv.auth_enabled is defined and taskserv.auth_enabled %}
        "auth": {"htpasswd": {"path": "/etc/zot/htpasswd"}, "failDelay": 0},{% endif %}{% if taskserv.pod_tls is defined and taskserv.pod_tls and taskserv.tls_secret is defined %}
        "tls": {"cert": "/etc/zot/ssl/tls.crt", "key": "/etc/zot/ssl/tls.key"},{% endif %}
        "realm": "zot",
        "accessControl": {
          "adminPolicy": {
            "users": ["{{ taskserv.admin_user | default(value="regadm") }}"]
          },
          "repositories": {
            "**":         {"anonymousPolicy": [], "defaultPolicy": []},
            "solera/**":     {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "images/**":     {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "lian-build/**": {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "cache/**":      {"anonymousPolicy": [],          "defaultPolicy": [],          "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "sccache/**": {"anonymousPolicy": [],          "defaultPolicy": [],          "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "crates/**":        {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "jesusperez.pro/**": {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "domains/**":   {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "modes/**":     {"anonymousPolicy": ["read"],   "defaultPolicy": ["read"],   "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]},
            "src-vault/**": {"anonymousPolicy": [],          "defaultPolicy": [],          "policies": [{"users": [{% for u in taskserv.write_users | default(value=[]) %}"{{ u }}"{% if not loop.last %},{% endif %}{% endfor %}], "actions": ["read","create","update","delete","detectManifestCollision"]}]}
          }
        }
      },
      "log": {"level": "info"},
      "extensions": {
        "search": {"enable": true},
        "ui":     {"enable": true},
        "trust":  {"enable": true, "cosign": true}{% if taskserv.sync_upstream is defined %},
        "sync": {
          "downloadDir": "{{ taskserv.data_dir | default(value="/var/lib/data/zot") }}/sync-tmp",
          "credentialsFile": "/etc/zot/sync-creds.json",
          "registries": [{
            "urls":      ["{{ taskserv.sync_upstream }}"],
            "tlsVerify": {{ taskserv.sync_tls | default(value=true) }},
            "onDemand":  {{ taskserv.sync_on_demand | default(value=true) }},
{%- if taskserv.sync_poll_interval is defined %}
            "pollInterval": "{{ taskserv.sync_poll_interval }}",
{%- endif %}
            "content":   [{% set prefixes = taskserv.sync_prefixes | default(value="domains/**,modes/**") | split(pat=",") %}{% for p in prefixes %}{"prefix": "{{ p | trim }}"}{% if not loop.last %},{% endif %}{% endfor %}]
          }]
        }{% endif %}
      }
    }