---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  annotations:
    meta.helm.sh/release-name: nfs-democratic-csi
    meta.helm.sh/release-namespace: democratic-csi
  name: secret-democratic-csi-driver-config-nfs
  namespace: democratic-csi
stringData:
  driver-config-file.yaml: |-
    driver: freenas-api-nfs
    ## generate guid `uuidgen` per helm release
    instance_id: B8712266-C1B5-4DCD-9DFD-C6646C0AD3A4
    httpConnection:
      protocol: http
      host: "${SECRET_TRUENAS_IP}"
      port: 80
      apiKey: "${SECRET_TRUENAS_APIKEY}"
      allowInsecure: true
    zfs:
      cli:
        ## allow non-root user to sudo
        sudoEnabled: true

      # can be used to set arbitrary values on the dataset/zvol
      # use handlebars templates with the parameters from the storage class/CO
      datasetProperties:
        "org.freenas:description": "flux-{{ parameters.[csi.storage.k8s.io/pvc/namespace] }}-{{ parameters.[csi.storage.k8s.io/pvc/name] }}"

      # total volume name (zvol/<datasetParentName>/<pvc name>) length cannot exceed 63 chars
      # standard volume naming overhead is 46 chars; datasetParentName should therefore be 17 chars or less
      datasetParentName: ssdpool/csi/nfs/v
      ## do NOT make datasetParentName and detachedSnapshotsDatasetParentName overlap
      ## they may be siblings, but neither should be nested in the other
      detachedSnapshotsDatasetParentName: ssdpool/csi/nfs/s
      datasetEnableQuotas: true
      datasetEnableReservation: false
      ## Set dataset permissions appropriately on TrueNAS
      datasetPermissionsMode: "0777"
      datasetPermissionsUser: 1001 # "${SECRET_TRUENAS_USER}"
      datasetPermissionsGroup: 33  # "www-data"

    nfs:
      shareCommentTemplate: "flux-{{ parameters.[csi.storage.k8s.io/pvc/namespace] }}-{{ parameters.[csi.storage.k8s.io/pvc/name] }}"
      shareHost: "${SECRET_TRUENAS_IP}"
      shareAlldirs: false
      shareAllowedHosts: []
      shareAllowedNetworks: [10.1.0.0/22, 10.2.0.0/16, 10.42.0.0/16, 10.43.0.0/16]
      ## Set dataset permissions appropriately on TrueNAS
      shareMaprootUser: "${SECRET_TRUENAS_USER}"
      shareMaprootGroup: "www-data"
      shareMapallUser: ""
      shareMapallGroup: ""
