Deploy ejabberd XMPP on Kubernetes
with PostgreSQL + CI/CD Pipeline

apiVersion: v2
name: ejabberd
description: Helm chart to deploy Ejabberd XMPP server with PostgreSQL backend
type: application
version: 1.0.0
appVersion: "latest"

# ─── Replica count ─────────────────────────────────────────
# Set to 1 to start; HPA will scale from hpa.minReplicas
replicaCount: 1

# ─── Container Image ───────────────────────────────────────
image:
  repository: ejabberd/ecs
  tag: "latest"
  pullPolicy: IfNotPresent

# ─── Image Pull Secrets (if using private registry) ────────
imagePullSecrets: []
# - name: my-registry-secret

# ─── Kubernetes Service ─────────────────────────────────────
service:
  name: ejabberd
  type: LoadBalancer
  loadBalancerIP: "192.168.0.100"  # your MetalLB / cloud LB IP
  ports:
    xmppClient: 5222
    xmppS2S: 5269
    httpAdmin: 5280

# ─── Persistent Storage (requires Longhorn installed) ───────
persistence:
  enabled: true
  storageClass: longhorn
  accessMode: ReadWriteOnce
  size: 5Gi

# ─── PostgreSQL Backend ─────────────────────────────────────
# DB must be reachable from inside the cluster
postgresql:
  host: "192.168.0.0"       # DB server IP reachable from cluster
  port: 5432
  user: "postgres"
  password: "postgrespassword"  # use a K8s secret in production
  database: "ejabberd"

# ─── Admin User ─────────────────────────────────────────────
# Used in ejabberd ACL. Create manually post-deploy (see Phase 5).
admin:
  username: admin
  password: adminpassword

# ─── Resources ──────────────────────────────────────────────
resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: 1
    memory: 1Gi

# ─── Horizontal Pod Autoscaler ──────────────────────────────
hpa:
  enabled: true
  minReplicas: 2
  maxReplicas: 5
  cpuThreshold: 70     # scale up when CPU > 70%

# ─── TLS ────────────────────────────────────────────────────
tls:
  enabled: true
  secretName: ejabberd-tls  # created in Phase 3

# ─── Virtual Hosts ──────────────────────────────────────────
# Add your XMPP domain(s) — must match your TLS cert CN/SAN
dynamicHosts:
  - local           # e.g. "chat.yourdomain.com" or just "local"

apiVersion: v1
kind: ConfigMap
metadata:
  name: ejabberd-config
  namespace: {{ .Release.Namespace }}
data:
  ejabberd.yml: |
    loglevel: info

    # Hosts defined in a separate ConfigMap (ejabberd-hosts)
    include_config_file:
      - "/home/ejabberd/conf/hosts.yml"

    # TLS certificate — created in Phase 3
    certfiles:
      - /home/ejabberd/certs/server.pem

    listen:
      # Port 5222 — XMPP Client connections with STARTTLS
      - port: 5222
        module: ejabberd_c2s
        starttls: true
        starttls_required: true
        shaper: normal
        max_stanza_size: 262144

      # Port 5280 — Web admin, BOSH, WebSocket, HTTP-API
      - port: 5280
        module: ejabberd_http
        tls: true
        custom_headers:
          "Access-Control-Allow-Origin": "*"
          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS"
          "Access-Control-Allow-Headers": "*"
          "Access-Control-Max-Age": "86400"
        request_handlers:
          /admin: ejabberd_web_admin
          /api:   mod_http_api
          /http-bind: mod_bosh
          /ws:    ejabberd_http_ws
          /bosh:  mod_bosh

    # ─── AUTHENTICATION ─────────────────────────
    # jwt: validates token-based logins first, sql: fallback for password auth
    auth_method: [jwt, sql]

    # JWT secret key file — mounted from K8s secret (ejabberd-jwt-secret)
    jwt_key: /home/ejabberd/conf/jwt_secret.txt

    # ─── DATABASE ───────────────────────────────
    default_db: sql
    sql_type: pgsql
    sql_server:   {{ .Values.postgresql.host }}
    sql_port:     {{ .Values.postgresql.port }}
    sql_database: {{ .Values.postgresql.database }}
    sql_username: {{ .Values.postgresql.user }}
    sql_password: {{ .Values.postgresql.password }}
    sql_ssl: true

    # ─── TRAFFIC SHAPING ────────────────────────
    shaper:
      normal: 1000
      fast: 5000

    # ─── ACCESS CONTROL ─────────────────────────
    acl:
      admin:
        user:
          - admin@local     # matches dynamicHosts[0]

    access_rules:
      configure:
        allow: admin
      c2s:
        allow: all
      shared_roster_access:
        allow: admin

    api_permissions:
      "registration":
        who: admin
        what: "*"
      "console commands":
        from: ejabberd_ctl
        who: all
        what: "*"
      "public commands":
        who: admin
        what:
          - status

    # ─── MODULES ────────────────────────────────
    # Add or remove modules based on your application needs
    modules:
      mod_adhoc: {}
      mod_admin_extra: {}
      mod_caps: {}
      mod_client_state:
        queue_presence: true
      mod_stream_mgmt:
        resend_on_timeout: true
      mod_shared_roster:
        db_type: sql
      mod_disco: {}
      mod_bosh: {}
      mod_roster:
        db_type: sql
      mod_offline:
        db_type: sql
        access_max_user_messages: all
      mod_mam:
        db_type: sql
        default: always
        request_activates_archiving: true
        assume_mam_usage: true
        cache_size: 1000
      mod_vcard:
        db_type: sql
        search: true
      mod_muc:
        db_type: sql
        host: "conference.@HOST@"
        access: all
        access_create: all
        access_persistent: all
        access_admin: admin
        history_size: 0
        default_room_options:
          mam: true
      mod_pubsub:
        db_type: sql
        plugins:
          - flat
          - pep
      mod_last:
        db_type: sql

apiVersion: v1
kind: ConfigMap
metadata:
  name: ejabberd-hosts
  namespace: {{ .Release.Namespace }}
data:
  hosts.yml: |
    hosts:
    {{- range .Values.dynamicHosts }}
      - {{ . }}
    {{- end }}

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: ejabberd
  namespace: {{ .Release.Namespace }}
spec:
  serviceName: {{ .Values.service.name }}
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      app: ejabberd
  template:
    metadata:
      labels:
        app: ejabberd
      annotations:
        # Triggers pod restart when configmap content changes
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
    spec:
      imagePullSecrets:
        {{- toYaml .Values.imagePullSecrets | nindent 8 }}

      containers:
        - name: ejabberd
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}

          resources:
            {{- toYaml .Values.resources | nindent 12 }}

          ports:
            - name: c2s
              containerPort: 5222
            - name: s2s
              containerPort: 5269
            - name: http
              containerPort: 5280

          # Readiness: wait for HTTP port to accept connections
          readinessProbe:
            tcpSocket:
              port: 5280
            initialDelaySeconds: 30
            periodSeconds: 15
            timeoutSeconds: 5
            failureThreshold: 10

          # Liveness: confirm XMPP port is alive
          livenessProbe:
            tcpSocket:
              port: 5222
            initialDelaySeconds: 30
            periodSeconds: 20
            failureThreshold: 3

          volumeMounts:
            # Main ejabberd config file
            - name: ejabberd-config
              mountPath: /home/ejabberd/conf/ejabberd.yml
              subPath: ejabberd.yml
            # Hosts file
            - name: ejabberd-hosts
              mountPath: /home/ejabberd/conf/hosts.yml
              subPath: hosts.yml
              readOnly: true
            # TLS certificate secret
            {{- if .Values.tls.enabled }}
            - name: tls
              mountPath: /home/ejabberd/certs
              readOnly: true
            {{- end }}
            # JWT secret key file for token-based authentication
            - name: jwt-secret
              mountPath: /home/ejabberd/conf/jwt_secret.txt
              subPath: jwt_secret.txt
              readOnly: true
            # Persistent data volume
            - name: data
              mountPath: /var/lib/ejabberd

      volumes:
        - name: ejabberd-config
          configMap:
            name: ejabberd-config
        - name: ejabberd-hosts
          configMap:
            name: ejabberd-hosts
        {{- if .Values.tls.enabled }}
        - name: tls
          secret:
            secretName: {{ .Values.tls.secretName }}
        {{- end }}
        # JWT key secret — must be created before deploying (see Phase 3 Step 2)
        - name: jwt-secret
          secret:
            secretName: ejabberd-jwt-secret

  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes:
          - {{ .Values.persistence.accessMode }}
        resources:
          requests:
            storage: {{ .Values.persistence.size }}
        storageClassName: {{ .Values.persistence.storageClass }}

apiVersion: v1
kind: Service
metadata:
  name: {{ .Values.service.name }}
  namespace: {{ .Release.Namespace }}
spec:
  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
  type: {{ .Values.service.type }}
  selector:
    app: ejabberd
  ports:
    - name: xmpp-client
      port: {{ .Values.service.ports.xmppClient }}
      targetPort: {{ .Values.service.ports.xmppClient }}
    - name: xmpp-s2s
      port: {{ .Values.service.ports.xmppS2S }}
      targetPort: {{ .Values.service.ports.xmppS2S }}
    - name: http-admin
      port: {{ .Values.service.ports.httpAdmin }}
      targetPort: {{ .Values.service.ports.httpAdmin }}

{{- if .Values.hpa.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: ejabberd-hpa
  namespace: {{ .Release.Namespace }}
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: StatefulSet
    name: ejabberd
  minReplicas: {{ .Values.hpa.minReplicas }}
  maxReplicas: {{ .Values.hpa.maxReplicas }}
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: {{ .Values.hpa.cpuThreshold }}
{{- end }}

# Create the namespace first if it doesn't exist
kubectl create namespace chat-system

# Create the TLS secret from the combined PEM file (generated in Step 1)
kubectl create secret generic ejabberd-tls \
  --from-file=server.pem \
  -n chat-system

# Verify it was created
kubectl get secret ejabberd-tls -n chat-system

# Copy the ejabberd self-signed cert into the image
COPY path/to/server.crt /usr/local/share/ca-certificates/ejabberd.crt

# Register it as a trusted CA
RUN update-ca-certificates

pipeline {
  agent any

  environment {
    NAMESPACE    = "chat-system"         // must match the NS used for the TLS secret
    HELM_RELEASE = "ejabberd"
    CHART_DIR    = "infra/ejabberd"         // path inside the cloned repo
    GIT_TOKEN    = credentials('github-creds')
  }

  stages {

    stage('Clean Workspace') {
      steps { cleanWs() }
    }

    stage('Checkout Helm Chart Repo') {
      steps {
        checkout([
          $class: 'GitSCM',
          branches: [[name: '*/main']],
          userRemoteConfigs: [[
            url: 'https://github.com/YOUR_ORG/helm.git',
            credentialsId: 'github-creds'
          ]]
        ])
      }
    }

    stage('Clone Repos') {
      steps {
        sh """
          git clone https://${GIT_TOKEN_USR}:${GIT_TOKEN_PSW}@github.com/YOUR_ORG/helm.git infra
        """
      }
    }

    stage('Helm Lint') {
      steps {
        dir("${CHART_DIR}") {
          sh 'helm lint .'
        }
      }
    }

    stage('Helm Deploy') {
      steps {
        script {
          withCredentials([
            file(credentialsId: 'kubeconfig',           variable: 'KUBECONFIG'),
            file(credentialsId: 'jwt-token-ejabberd',   variable: 'JWT_TOKEN')
          ]) {
            dir("${CHART_DIR}") {
              sh """
                echo "🔧 Deploying Ejabberd Helm chart to namespace: ${NAMESPACE}"
                helm upgrade --install ${HELM_RELEASE} . \\
                  --namespace ${NAMESPACE} \\
                  --create-namespace \\
                  --wait --timeout=300s
                echo "✅ Deployment complete"
              """
            }
          }
        }
      }
    }

  }

  post {
    success {
      script {
        echo "🚀 Ejabberd deployed successfully!"
        withCredentials([file(credentialsId: 'kubeconfig', variable: 'KUBECONFIG')]) {
          sh "kubectl get pods -n ${NAMESPACE}"
          sh "kubectl get svc  -n ${NAMESPACE}"
        }
      }
    }
    failure {
      echo "❌ Deployment failed — check Helm lint output and pod events above"
    }
  }
}

# 1. Confirm namespace exists (or let the pipeline create it)
kubectl get namespace chat-system

# 2. Confirm TLS secret is present
kubectl get secret ejabberd-tls -n chat-system

# 3. Confirm JWT secret is present
kubectl get secret ejabberd-jwt-secret -n chat-system

# 3. Confirm Longhorn storage class is available
kubectl get storageclass | grep longhorn

# 4. Confirm DB is reachable from cluster
kubectl run pg-test --rm -it --image=postgres --restart=Never -n chat-system \
  -- psql -h 192.168.0.0 -U postgres -d ejabberd -c '\dt'

# 5. Dry-run the Helm chart locally before triggering Jenkins
helm install ejabberd ./ejabberd --namespace chat-system --dry-run --debug