apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ luanti_wasm_name | to_json }}
  namespace: {{ luanti_wasm_namespace | to_json }}
spec:
  replicas: {{ luanti_wasm_replicas }}
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: {{ luanti_wasm_name | to_json }}
  template:
    metadata:
      labels:
        app: {{ luanti_wasm_name | to_json }}
      annotations:
        checksum/config: {{ lookup('ansible.builtin.template', 'configmap.yml.j2') | hash('sha256') | to_json }}
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        fsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      imagePullSecrets: {{ luanti_wasm_image_pull_secrets | to_json }}
      nodeSelector: {{ luanti_wasm_node_selector | to_json }}
      tolerations: {{ luanti_wasm_tolerations | to_json }}
      containers:
        - name: web
          image: {{ luanti_wasm_web_image | to_json }}
          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
          securityContext:
            runAsNonRoot: true
            runAsUser: 101
            runAsGroup: 101
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          startupProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 20
          resources: {{ luanti_wasm_web_resources | to_json }}
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: tmp
              mountPath: /tmp
        - name: proxy
          image: {{ luanti_wasm_proxy_image | to_json }}
          imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          ports:
            - name: proxy
              containerPort: 7777
              protocol: TCP
          startupProbe:
            tcpSocket:
              port: proxy
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:
            tcpSocket:
              port: proxy
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: proxy
            periodSeconds: 20
          resources: {{ luanti_wasm_proxy_resources | to_json }}
          volumeMounts:
            - name: config
              mountPath: /etc/lwproxy.toml
              subPath: lwproxy.toml
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: {{ (luanti_wasm_name ~ '-config') | to_json }}
            defaultMode: 0444
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: {{ luanti_wasm_tmp_size_limit | to_json }}