name: server

variables:
  - name: password
    value: ''
    secret: true
  - name: maxmemory
    value: ''

fodder:
- name: server
  type: cloud-config
  secret: true
  content: |
    # Append (don't replace) write_files/runcmd when combined with other
    # cloud-config fodder on the same catlet, e.g. a co-located application.
    merge_how:
    - name: list
      settings: [append]
    - name: dict
      settings: [no_replace, recurse_list]
    write_files:
    - path: /opt/eryph-valkey-setup.sh
      permissions: '0755'
      content: |
        #!/bin/bash
        set -euo pipefail
        PASSWORD='{{ password }}'
        MAXMEMORY='{{ maxmemory }}'

        . /etc/os-release
        FAMILY=rhel
        case " ${ID:-} ${ID_LIKE:-} " in
          *" debian "*|*" ubuntu "*) FAMILY=debian ;;
        esac

        # Valkey is the Redis-compatible server shipped by both families
        # (the RHEL family no longer packages redis). Debian provides both;
        # we standardise on valkey so behaviour is identical everywhere.
        if [ "$FAMILY" = debian ]; then
          export DEBIAN_FRONTEND=noninteractive
          apt-get update -qq
          apt-get install -y -qq valkey-server
        else
          dnf install -y -q valkey
        fi

        # Service unit name differs (Debian: valkey-server, RHEL: valkey)
        SVC=valkey
        systemctl list-unit-files | grep -q '^valkey-server.service' && SVC=valkey-server

        # Configure remote access (config path is /etc/valkey/valkey.conf on both)
        CONF=/etc/valkey/valkey.conf
        sed -i '/# eryph-begin/,/# eryph-end/d' "$CONF"
        {
          echo "# eryph-begin"
          echo "bind 0.0.0.0"
          echo "protected-mode no"
          [ -n "$PASSWORD" ] && echo "requirepass $PASSWORD"
          if [ -n "$MAXMEMORY" ]; then
            echo "maxmemory $MAXMEMORY"
            echo "maxmemory-policy allkeys-lru"
          fi
          echo "# eryph-end"
        } >> "$CONF"

        systemctl enable "$SVC" >/dev/null 2>&1 || true
        systemctl restart "$SVC"

        # Open the firewall only when one is active
        if command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1; then
          firewall-cmd --permanent --add-port=6379/tcp >/dev/null; firewall-cmd --reload >/dev/null
        fi
        if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
          ufw allow 6379/tcp >/dev/null
        fi
    runcmd:
    - bash /opt/eryph-valkey-setup.sh