apiVersion: v1
kind: Namespace
metadata:
  name: platform-registry
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: platform-registry-gateway
  namespace: platform-registry
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: platform-registry-gateway
  namespace: platform-registry
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: platform-registry-gateway
  template:
    metadata:
      labels:
        app.kubernetes.io/name: platform-registry-gateway
    spec:
      serviceAccountName: platform-registry-gateway
      automountServiceAccountToken: false
      imagePullSecrets:
        - name: overdeck-ghcr-pull
      nodeSelector:
        kubernetes.io/hostname: debian3
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: admit-packages
          image: ghcr.io/alexcodeplace/overdeck-agent-sandbox@sha256:441c3a0e6e3f5afe07571fd83dd0d64af5b15ad98bfc3b4cbe119cdc30b4511b
          command:
            - /bin/sh
            - -ceu
            - |
              node /inputs/admit-package.mjs /inputs/query-react.tgz @platform-modules/query-react 0.1.0 /mirror http://100.101.104.41:4873 2026-07-06T07:29:58Z
              node /inputs/admit-package.mjs /inputs/ui-primitives.tgz @platform-modules/ui-primitives 0.5.0 /mirror http://100.101.104.41:4873 2026-08-05T12:01:34Z
              node /inputs/admit-package.mjs /inputs/ui-tokens.tgz @platform-modules/ui-tokens 0.2.0 /mirror http://100.101.104.41:4873 2026-06-25T08:57:32Z
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: inputs
              mountPath: /inputs
              readOnly: true
            - name: mirror
              mountPath: /mirror
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
      containers:
        - name: gateway
          image: ghcr.io/alexcodeplace/overdeck-agent-sandbox@sha256:441c3a0e6e3f5afe07571fd83dd0d64af5b15ad98bfc3b4cbe119cdc30b4511b
          command: ["/usr/local/bin/node", "/inputs/server.mjs"]
          env:
            - name: REGISTRY_MIRROR
              value: /mirror
            - name: REGISTRY_HOST
              value: 0.0.0.0
            - name: REGISTRY_PORT
              value: "4873"
          ports:
            - name: npm-registry
              containerPort: 4873
          readinessProbe:
            httpGet:
              path: /%40platform-modules%2Fquery-react
              port: npm-registry
            initialDelaySeconds: 1
            periodSeconds: 2
          livenessProbe:
            httpGet:
              path: /%40platform-modules%2Fquery-react
              port: npm-registry
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: inputs
              mountPath: /inputs
              readOnly: true
            - name: mirror
              mountPath: /mirror
              readOnly: true
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 250m
              memory: 128Mi
      volumes:
        - name: inputs
          configMap:
            name: __INPUT_CONFIG_MAP__
        - name: mirror
          emptyDir:
            sizeLimit: 16Mi
---
apiVersion: v1
kind: Service
metadata:
  name: platform-registry-gateway
  namespace: platform-registry
spec:
  selector:
    app.kubernetes.io/name: platform-registry-gateway
  externalIPs:
    - 100.101.104.41
  ports:
    - name: npm-registry
      port: 4873
      targetPort: npm-registry
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-registry-gateway-default-deny
  namespace: platform-registry
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-registry-gateway
  policyTypes: ["Ingress", "Egress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: platform-registry-gateway-readers
  namespace: platform-registry
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: platform-registry-gateway
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - ipBlock:
            cidr: 100.64.0.0/10
        - namespaceSelector:
            matchExpressions:
              - key: kubernetes.io/metadata.name
                operator: In
                values: ["arc-ci", "overdeck-factory"]
      ports:
        - protocol: TCP
          port: 4873
