apiVersion: v1
kind: Secret
metadata:
  name: rabbitmq-credentials
type: Opaque
stringData:
  username: admin
  password: "$RABBITMQ_PASS"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: rabbitmq-config
data:
  rabbitmq.conf: |
    listeners.tcp = none
    listeners.ssl.default = 5671
    ssl_options.certfile = /etc/rabbitmq/tls/tls.crt
    ssl_options.keyfile = /etc/rabbitmq/tls/tls.key
    ssl_options.verify = verify_none
    ssl_options.fail_if_no_peer_cert = false
    management.listener.port = 15672
    management.listener.ssl = false
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: rabbitmq-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: rabbitmq
spec:
  serviceName: rabbitmq
  replicas: 1
  selector:
    matchLabels:
      app: rabbitmq
  template:
    metadata:
      labels:
        app: rabbitmq
    spec:
      imagePullSecrets:
      - name: regcred
      securityContext:
        fsGroup: 999
      initContainers:
        - name: fix-permissions
          image: localhost:32000/busybox:1.36
          command:
            - sh
            - -c
            - |
              chown -R 999:999 /var/lib/rabbitmq
              chmod 700 /var/lib/rabbitmq
              if [ -f /var/lib/rabbitmq/.erlang.cookie ]; then
                chmod 600 /var/lib/rabbitmq/.erlang.cookie
              fi
          volumeMounts:
            - name: data
              mountPath: /var/lib/rabbitmq
      containers:
        - name: rabbitmq
          image: localhost:32000/rabbitmq:3.11-management
          ports:
            - containerPort: 5671
              name: amqps
            - containerPort: 15672
              name: management
          env:
            - name: RABBITMQ_CONFIG_FILE
              value: /etc/rabbitmq/conf/rabbitmq
            - name: RABBITMQ_ERLANG_COOKIE
              value: "$RABBITMQ_ERLANG_COOKIE"
            - name: RABBITMQ_DEFAULT_USER
              valueFrom:
                secretKeyRef:
                  name: rabbitmq-credentials
                  key: username
            - name: RABBITMQ_DEFAULT_PASS
              valueFrom:
                secretKeyRef:
                  name: rabbitmq-credentials
                  key: password
          volumeMounts:
            - name: config
              mountPath: /etc/rabbitmq/conf
              readOnly: true
            - name: tls
              mountPath: /etc/rabbitmq/tls
              readOnly: true
            - name: data
              mountPath: /var/lib/rabbitmq
          lifecycle:
            postStart:
              exec:
                command:
                  - /bin/sh
                  - -c
                  - |
                    until rabbitmqctl status >/dev/null 2>&1; do
                      echo "Waiting for RabbitMQ to start..."
                      sleep 5
                    done
                    echo "Creating virtual hosts"
                    rabbitmqctl add_vhost email || true
                    rabbitmqctl add_vhost tg || true
                    rabbitmqctl add_vhost vk || true
                    rabbitmqctl add_vhost fb || true
                    rabbitmqctl add_vhost ok || true
                    rabbitmqctl add_vhost max || true
                    rabbitmqctl add_vhost inst || true

                    rabbitmqctl set_permissions -p email admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p tg admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p vk admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p fb admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p ok admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p max admin ".*" ".*" ".*" || true
                    rabbitmqctl set_permissions -p inst admin ".*" ".*" ".*" || true
                    
                    rabbitmqctl set_user_tags admin administrator || true
                    
                    echo "Virtual hosts created and configured for admin user."
      volumes:
        - name: config
          configMap:
            name: rabbitmq-config
            items:
              - key: rabbitmq.conf
                path: rabbitmq.conf
        - name: tls
          secret:
            secretName: rabbitmq-tls
        - name: data
          persistentVolumeClaim:
            claimName: rabbitmq-data
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
---
apiVersion: v1
kind: Service
metadata:
  name: rabbitmq
spec:
  selector:
    app: rabbitmq
  ports:
    - name: amqps
      port: 5671
      targetPort: 5671
      nodePort: 31023
    - name: management
      port: 15672
      targetPort: 15672
  type: NodePort 
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rabbitmq-management
  annotations:
    cert-manager.io/cluster-issuer: google-public-ca
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
spec:
  tls:
    - hosts:
        - rabbit.spiritofweb.ru
      secretName: rabbitmq-tls
  rules:
    - host: rabbit.spiritofweb.ru
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: rabbitmq
                port:
                  number: 15672