apiVersion: v1
kind: ConfigMap
metadata:
  name: awp-fabro-config
  namespace: awp-system
data:
  settings.toml: |
    _version = 1

    [server.web]
    enabled = false

    [server.auth]
    methods = ["dev-token"]

    [server.logging]
    destination = "stdout"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: awp-fabro-state
  namespace: awp-system
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: awp-fabro
  namespace: awp-system
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: awp-fabro
  template:
    metadata:
      labels:
        app.kubernetes.io/name: awp-fabro
        app.kubernetes.io/part-of: awp
    spec:
      nodeSelector:
        kubernetes.io/hostname: debian3
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: fabro
          image: __AWP_FABRO_IMAGE__
          imagePullPolicy: IfNotPresent
          args:
            - sh
            - -c
            - >-
              exec fabro server start --foreground --no-web --no-upgrade-check
              --bind 0.0.0.0:32276 --config /etc/fabro/settings.toml
              --storage-dir /storage
          env:
            - name: FABRO_HOME
              value: /storage/.home
            - name: FABRO_STORAGE_DIR
              value: /storage
            - name: FABRO_LOG_DESTINATION
              value: stdout
            - name: FABRO_DEV_TOKEN
              valueFrom:
                secretKeyRef:
                  name: awp-fabro-secrets
                  key: FABRO_DEV_TOKEN
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: awp-fabro-secrets
                  key: SESSION_SECRET
          ports:
            - name: http
              containerPort: 32276
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 2
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 8
            periodSeconds: 10
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: "2"
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ALL]
          volumeMounts:
            - name: state
              mountPath: /storage
            - name: config
              mountPath: /etc/fabro
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: state
          persistentVolumeClaim:
            claimName: awp-fabro-state
        - name: config
          configMap:
            name: awp-fabro-config
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: awp-fabro
  namespace: awp-system
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: awp-fabro
  ports:
    - name: http
      port: 32276
      targetPort: http
