trakrf-backend.yaml

{{- /*
  One trakrf-backend Application per env. Per-env config (DB host, ingress
  flag) lives in .Values.envs at the root chart values level — the template
  has zero env-name string conditionals, so adding a third env (whitelabel
  tenant, etc.) is a values change only.

  Preview gets ingress + IPAllowList middlewares wired up via the
  trakrf-backend.ingressValues helper. Prod stays ingress-off for the
  CF grey-cloud route; the gke-direct route is rendered when ingressEnabled.

  On GKE, automatic image-tag promotion for preview is handled by an
  ImageUpdater CR (see trakrf-backend-image-updater.yaml). The chart 1.2.x
  controller is CRD-driven, so the Application itself carries no
  image-updater annotations — they would be inert.
*/ -}}
{{- range $env, $cfg := $.Values.envs }}
{{- $base := printf "database:\n  name: trakrf\n  user: trakrf-app\n  credentialsSecret: trakrf-app-credentials\n  host: %s\nmigrate:\n  database: trakrf\n  user: trakrf-migrate\n  credentialsSecret: trakrf-migrate-credentials\n  host: %s\nconfig:\n  appEnv: %s\n  environmentLabel: %q\n" $cfg.dbHost $cfg.dbHost $env $cfg.environmentLabel }}
{{- /* Per-env access-token TTL (TRA-843). Appended to the config block BEFORE
       the top-level image: key below. Empty falls back to the chart default in
       helm/trakrf-backend/values.yaml ("3600"). */ -}}
{{- if $cfg.jwtExpirationSeconds }}
{{- $base = printf "%s  jwtExpirationSeconds: %q\n" $base $cfg.jwtExpirationSeconds }}
{{- end }}
{{- /* Per-env runtime log level (TRA-974). Maps to the chart's
       config.runtimeLogLevel → LOG_LEVEL env the backend logger reads. Preview
       pins "info" to silence the EnvDev debug default (per-message ingest
       firehose); prod/unset envs fall back to the backend's APP_ENV default
       (production→warn). A config sub-key, so append BEFORE the top-level
       image:/mqtt:/emailGuard: blocks. */ -}}
{{- if $cfg.logLevel }}
{{- $base = printf "%s  runtimeLogLevel: %q\n" $base $cfg.logLevel }}
{{- end }}
{{- if $cfg.imageTag }}
{{- $base = printf "%simage:\n  tag: %q\n" $base $cfg.imageTag }}
{{- end }}
{{- /* TRA-920: enable live MQTT ingestion. mqtt.host is the chart's enable
       trigger; clientId is distinct per env (and from the RC ingester) to avoid
       broker duplicate-id eviction. port/scheme/topic/authSecret come from the
       chart defaults in helm/trakrf-backend/values.yaml. */ -}}
{{- if $cfg.mqttEnabled }}
{{- $base = printf "%smqtt:\n  host: mqtt.%s.gke.trakrf.id\n  clientId: trakrf-backend-%s-%s\n" $base $env $.Values.cluster $env }}
{{- end }}
{{- /* TRA-972: RESEND_API_KEY PreSync guard. Enabled per-env (preview now; prod
       only AFTER its key is injected, or the guard blocks live prod syncs). The
       guard image comes from the chart default (busybox). */ -}}
{{- if $cfg.emailGuardEnabled }}
{{- $base = printf "%semailGuard:\n  enabled: true\n" $base }}
{{- end }}
{{- $ingress := "ingress:\n  enabled: false\n" }}
{{- if $cfg.ingressEnabled }}
{{- $ingressCtx := dict
      "env" $env
      "appTrakrfIdHost" $cfg.appTrakrfIdHost
      "breakglassSourceCidr" $.Values.breakglassSourceCidr
      "cloudflareIpv4Cidrs" $.Values.cloudflareIpv4Cidrs
      "cloudflareIpv6Cidrs" $.Values.cloudflareIpv6Cidrs }}
{{- $ingress = include "trakrf-backend.ingressValues" $ingressCtx }}
{{- end }}
{{- $values := printf "%s%s" $base $ingress }}
{{- /*
  JWT_SECRET and RESEND_API_KEY are real, externally-set values (kubectl-managed
  in-cluster, not in git — no ESO/sealed-secret ceremony today). The chart's
  secret.yaml omits each when empty/placeholder; without this carve-out ArgoCD
  selfHeal reverts the operator-set values on sync. For JWT that trips the
  backend's TRA-860/#428 fail-fast boot guard; for RESEND it silently empties the
  key so email send fails with Resend "API key is invalid" (the Railway→GKE
  migration miss). ignoreDifferences (diff) + RespectIgnoreDifferences (sync) make
  both stick across syncs. Applies per-env, so prod inherits the carve-out at
  cutover (its real secrets must be set the same way — see TRA-375).
  TODO durable: replace the manual secret source with External Secrets + GCP
  Secret Manager (TRA-375 follow-up); the carve-out stays correct either way.
*/ -}}
{{- $ignore := printf "- group: \"\"\n  kind: Secret\n  name: trakrf-backend\n  namespace: trakrf-%s\n  jsonPointers:\n    - /data/JWT_SECRET\n    - /data/RESEND_API_KEY\n" $env }}
---
{{- include "trakrf.application" (dict
  "name" (printf "trakrf-backend-%s" $env)
  "path" "helm/trakrf-backend"
  "namespace" (printf "trakrf-%s" $env)
  "syncWave" "1"
  "cluster" $.Values.cluster
  "repoURL" $.Values.repoURL
  "targetRevision" $.Values.targetRevision
  "destination" $.Values.destination
  "inlineValues" $values
  "ignoreDifferences" $ignore
  "extraSyncOptions" (list "RespectIgnoreDifferences=true")
) }}
{{- end }}