{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: auth
  namespace: sme
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sme-auth
  template:
    metadata:
      labels:
        app: sme-auth
    spec:
      serviceAccountName: auth
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: ghcr-pull
      containers:
        - name: auth
          # See marketplace.yaml: this directory is Kustomize-applied by the
          # contabo-mkt Flux Kustomization (Sovereigns skip via .helmignore),
          # so the image must be a concrete string. PR #580 templated it and
          # pinned the new ReplicaSet at InvalidImageName since 2026-05-02.
          image: ghcr.io/openova-io/openova/services-auth:59367b2
          imagePullPolicy: Always
          ports:
            - containerPort: 8081
          env:
            - name: PG_USER
              valueFrom:
                secretKeyRef:
                  name: sme-pg-app
                  key: username
            - name: PG_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sme-pg-app
                  key: password
            - name: POSTGRES_HOST
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: POSTGRES_HOST
            - name: POSTGRES_PORT
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: POSTGRES_PORT
            - name: DATABASE_URL
              value: "postgres://$(PG_USER):$(PG_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/sme_auth?sslmode=disable"
            - name: VALKEY_ADDR
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: VALKEY_ADDR
            # bp-valkey ships auth.enabled=true (bitnami default); the
            # `default` ACL user uses requirepass, so VALKEY_USERNAME stays
            # empty and VALKEY_PASSWORD reads from the cross-ns mirror
            # Secret rendered by templates/sme-services/valkey-cross-ns-
            # secret.yaml. Issue #863. optional=true so contabo-mkt's
            # auth-less in-namespace Valkey (data/valkey.yaml) works
            # unchanged — empty VALKEY_PASSWORD triggers the no-auth
            # connect path in core/services/shared/db/valkey.go.
            - name: VALKEY_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sme-valkey-auth
                  key: valkey-password
                  optional: true
            - name: REDPANDA_BROKERS
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: REDPANDA_BROKERS
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: JWT_SECRET
            - name: JWT_REFRESH_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: JWT_REFRESH_SECRET
            - name: GOOGLE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: GOOGLE_CLIENT_ID
            - name: GOOGLE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: GOOGLE_CLIENT_SECRET
            - name: BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: PUBLIC_API_BASE_URL
            - name: SMTP_HOST
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_HOST
            - name: SMTP_PORT
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_PORT
            - name: SMTP_FROM
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_FROM
            - name: SMTP_USER
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_USER
            - name: SMTP_PASS
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: SMTP_PASS
            - name: CORS_ORIGIN
              valueFrom:
                configMapKeyRef:
                  name: sme-services-config
                  key: CORS_ORIGIN_ADMIN
            - name: ADMIN_EMAIL
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: ADMIN_EMAIL
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sme-secrets
                  key: ADMIN_PASSWORD
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              cpu: 500m
              memory: 128Mi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8081
            initialDelaySeconds: 3
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 65534
---
apiVersion: v1
kind: Service
metadata:
  name: auth
  namespace: sme
spec:
  selector:
    app: sme-auth
  ports:
    - port: 8081
      targetPort: 8081
{{- end }}
