apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth
  namespace: sme
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sme-auth
  template:
    metadata:
      labels:
        app: sme-auth
    spec:
      serviceAccountName: auth
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: ghcr-pull-secret
      containers:
        - name: auth
          image: ghcr.io/openova-io/openova/services-auth:046e5eb
          imagePullPolicy: Always
          ports:
            - containerPort: 8081
          env:
            - name: PG_USER
              valueFrom:
                secretKeyRef:
                  name: sme-pg-app
                  key: username
            - name: PG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sme-pg-app
                  key: password
            - name: POSTGRES_HOST
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: POSTGRES_HOST
            - name: POSTGRES_PORT
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: POSTGRES_PORT
            - name: DATABASE_URL
              value: "postgres://$(PG_USER):$(PG_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/sme_auth?sslmode=disable"
            - name: VALKEY_ADDR
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: VALKEY_ADDR
            - name: REDPANDA_BROKERS
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: REDPANDA_BROKERS
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: JWT_SECRET
            - name: JWT_REFRESH_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: JWT_REFRESH_SECRET
            - name: GOOGLE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: GOOGLE_CLIENT_ID
            - name: GOOGLE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: GOOGLE_CLIENT_SECRET
            - name: BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: PUBLIC_API_BASE_URL
            - name: SMTP_HOST
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_HOST
            - name: SMTP_PORT
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_PORT
            - name: SMTP_FROM
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_FROM
            - name: SMTP_USER
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_USER
            - name: SMTP_PASS
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_PASS
            - name: CORS_ORIGIN
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: CORS_ORIGIN_ADMIN
            - name: ADMIN_EMAIL
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: ADMIN_EMAIL
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: ADMIN_PASSWORD
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 500m
              memory: 128Mi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 3
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 65534
---
apiVersion: v1
kind: Service
metadata:
  name: auth
  namespace: sme
spec:
  selector:
    app: sme-auth
  ports:
    - port: 8081
      targetPort: 8081
