apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "hlf-ord.fullname" . }}
  labels:
{{ include "labels.standard" . | indent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: {{ include "hlf-ord.name" . }}
      release: {{ .Release.Name }}
  template:
    metadata:
      labels:
{{ include "labels.standard" . | indent 8 }}
    spec:
      volumes:
        - name: data
        {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "hlf-ord.fullname" .) }}
        {{- else }}
          emptyDir: {}
        {{- end }}
        - name: genesis
          secret:
            secretName: {{ .Values.secrets.genesis }}
        - name: admin-cert
          secret:
            secretName: {{ .Values.secrets.adminCert }}
      containers:
        - name: orderer
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: ord-port
              containerPort: 7050
              protocol: TCP
          # TODO: Add liveness and readiness probes
          command:
            - sh
            - -c
            - |
              # Download Fabric CA-client if it does not exist
              if [ ! -f /bin/fabric-ca-client ]
              then
                if [ ! -f /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz ]
                then
                  # Curl is needed to download Fabric CA-client
                  apt update
                  apt install curl -y

                  echo "Downloading Fabric CA-client"
                  curl -f -s -C - https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/hyperledger-fabric-ca/${HLF_TOOLS_BUILD}/hyperledger-fabric-ca-${HLF_TOOLS_BUILD}.tar.gz > /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz
                fi
                echo "Unzipping Fabric CA-client"
                tar xzf /var/hyperledger/fabric-ca-${HLF_TOOLS_BUILD}.tar.gz -C /
              fi

              while [ ! -f ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts/cert.pem ];
              do
                echo ">\033[0;35m fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR} \033[0m"
                fabric-ca-client enroll -d -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M ${ORDERER_GENERAL_LOCALMSPDIR}

                if [ ! -f ${ORDERER_GENERAL_LOCALMSPDIR}/signcerts/cert.pem ]
                then
                  echo ">\033[0;31m Unable to enroll Orderer, make sure you have registered them first \(sleeping 180 seconds and re-trying\) \033[0m"
                  sleep 180
                fi
              done

              echo ">\033[0;32m Copy admincerts to ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts \033[0m"
              mkdir -p ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts
              cp /hl_config/admin/signcerts/* ${ORDERER_GENERAL_LOCALMSPDIR}/admincerts

              echo ">\033[0;32m Setup admin certificates in ${ADMIN_MSP_PATH} \033[0m"
              mkdir -p ${ADMIN_MSP_PATH} ${ADMIN_MSP_PATH}/cacerts ${ADMIN_MSP_PATH}/intermediatecerts
              cp -L -r /hl_config/admin/* ${ADMIN_MSP_PATH}
              cp ${ORDERER_GENERAL_LOCALMSPDIR}/cacerts/* ${ADMIN_MSP_PATH}/cacerts
              cp ${ORDERER_GENERAL_LOCALMSPDIR}/intermediatecerts/* ${ADMIN_MSP_PATH}/intermediatecerts

              # Create TLS certificate for Orderer
              if [ ! -f ${ORDERER_GENERAL_TLS_PRIVATEKEY} ]
              then
                echo ">\033[0;35m fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@http://${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }} \033[0m"
                fabric-ca-client enroll -d --enrollment.profile tls -u http://${CA_USERNAME}:${CA_PASSWORD}@${CA_ADDRESS} -M /tmp/tls --csr.hosts {{ include "hlf-ord.fullname" . }}

                mkdir -p $(dirname $ORDERER_GENERAL_TLS_PRIVATEKEY)
                cp /tmp/tls/keystore/* $ORDERER_GENERAL_TLS_PRIVATEKEY
                mkdir -p $(dirname $ORDERER_GENERAL_TLS_CERTIFICATE)
                cp /tmp/tls/signcerts/* $ORDERER_GENERAL_TLS_CERTIFICATE
                rm -rf /tmp/tls
              fi

              # Create directories to avoid restarts
              mkdir -p ${ORDERER_FILELEDGER_LOCATION}
              mkdir -p ${ORDERER_FILELEDGER_LOCATION}/index

              echo ">\033[0;35m orderer \033[0m"
              orderer
          envFrom:
            - secretRef:
                name: {{ include "hlf-ord.fullname" . }}
            - configMapRef:
                name: {{ include "hlf-ord.fullname" . }}--ord
          ports:
            - name: ord-port
              containerPort: 7050
              protocol: TCP
          volumeMounts:
            - mountPath: /var/hyperledger
              name: data
            - mountPath: /hl_config/genesis
              name: genesis
            - mountPath: /hl_config/admin/admincerts
              name: admin-cert
            - mountPath: /hl_config/admin/signcerts
              name: admin-cert
          resources:
{{ toYaml .Values.resources | indent 12 }}
    {{- with .Values.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.affinity }}
      affinity:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
