# Meilisearch for IIOS message search (prod).
#
# IIOS deploys to Kubernetes via ArgoCD from the platform-engineering/k8s-pods repo
# (services/iios/). This file is the template for the prod Meilisearch instance — copy it into
# k8s-pods/services/iios/meilisearch.yaml and let ArgoCD sync it. Then wire the service:
#
#   1. Create the master key once (32+ random chars) and set it in the Secret below (or via a
#      sealed-secret / your secret manager — do NOT commit a real key in plaintext):
#        kubectl -n <iios-namespace> create secret generic iios-meili \
#          --from-literal=MEILI_MASTER_KEY="$(openssl rand -base64 32)"
#   2. Add these env vars to the iios-service Deployment (services/iios/deployment.yaml):
#        - name: MEILI_URL
#          value: http://meilisearch:7700
#        - name: MEILI_KEY
#          valueFrom: { secretKeyRef: { name: iios-meili, key: MEILI_MASTER_KEY } }
#   3. After the first deploy, backfill existing messages once: POST /v1/search/reindex per tenant
#      (authenticated as a scope member) — new messages index automatically on message.sent.
#
# Set the namespace on each object (or via kustomize) to match the iios-service namespace so the
# `meilisearch` Service DNS resolves as http://meilisearch:7700 from the pod.
---
apiVersion: v1
kind: Secret
metadata:
  name: iios-meili
type: Opaque
stringData:
  # Replace with a real key (or manage out-of-band per note #1 and delete this stringData block).
  MEILI_MASTER_KEY: "CHANGE_ME_meili_master_key"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: iios-meili-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: meilisearch
  labels: { app: meilisearch }
spec:
  replicas: 1
  strategy: { type: Recreate } # single RWO volume — never run two writers
  selector:
    matchLabels: { app: meilisearch }
  template:
    metadata:
      labels: { app: meilisearch }
    spec:
      containers:
        - name: meilisearch
          image: getmeili/meilisearch:v1.11
          ports:
            - containerPort: 7700
          env:
            - name: MEILI_ENV
              value: "production"
            - name: MEILI_NO_ANALYTICS
              value: "true"
            - name: MEILI_MASTER_KEY
              valueFrom:
                secretKeyRef: { name: iios-meili, key: MEILI_MASTER_KEY }
          volumeMounts:
            - name: data
              mountPath: /meili_data
          resources:
            requests: { cpu: "100m", memory: "256Mi" }
            limits: { cpu: "1", memory: "1Gi" }
          readinessProbe:
            httpGet: { path: /health, port: 7700 }
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet: { path: /health, port: 7700 }
            initialDelaySeconds: 15
            periodSeconds: 20
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: iios-meili-data
---
apiVersion: v1
kind: Service
metadata:
  name: meilisearch
  labels: { app: meilisearch }
spec:
  selector: { app: meilisearch }
  ports:
    - port: 7700
      targetPort: 7700
  # ClusterIP (internal only) — reached by iios-service as http://meilisearch:7700.
  type: ClusterIP