# SPDX-License-Identifier: MIT-0
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ wikideck_name | to_json }}
  namespace: {{ wikideck_namespace | to_json }}
  labels:
    app.kubernetes.io/name: wikideck
    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
    app.kubernetes.io/managed-by: ansible
spec:
  # Never expose replicas as a variable: chain.json has no multi-writer locking.
  replicas: 1
  strategy:
    type: Recreate
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: wikideck
      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: wikideck
        app.kubernetes.io/instance: {{ wikideck_name | to_json }}
    spec:
      serviceAccountName: {{ wikideck_name | to_json }}
      automountServiceAccountToken: false
      enableServiceLinks: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
{% if wikideck_image_pull_secrets | length > 0 %}
      imagePullSecrets:
{% for secret in wikideck_image_pull_secrets %}
        - name: {{ secret | to_json }}
{% endfor %}
{% endif %}
      nodeSelector: {{ wikideck_node_selector | to_json }}
      tolerations: {{ wikideck_tolerations | to_json }}
      affinity: {{ wikideck_affinity | to_json }}
      containers:
        - name: wikideck
          image: {{ wikideck_image | to_json }}
          imagePullPolicy: {{ wikideck_image_pull_policy | to_json }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          ports:
            - name: http
              containerPort: 3001
              protocol: TCP
          env:
            - name: NODE_ENV
              value: production
            - name: HOST
              value: "0.0.0.0"
            - name: PORT
              value: "3001"
            - name: WIKIDECK_DATA_DIR
              value: /app/data
            - name: WIKIDECK_OFFLINE
              value: {{ ('1' if wikideck_offline else '0') | to_json }}
{% if wikideck_public_origin | length > 0 %}
            - name: PUBLIC_ORIGIN
              value: {{ wikideck_public_origin | to_json }}
{% endif %}
          resources: {{ wikideck_resources | to_json }}
          startupProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 60
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: {{ (wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data') | to_json }}
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 32Mi