apiVersion: apps/v1
kind: Deployment
metadata:
  name: expense-tracker
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker
    {{- include "expense-tracker.labels" . | nindent 4 }}
  annotations:
    # Stakater Reloader: rolling restart when ESO refreshes a secret from OpenBao
    # (env vars are only read at container start). Harmless if Reloader is not installed.
    secret.reloader.stakater.com/reload: "expense-tracker-app,expense-tracker-db"
spec:
  replicas: {{ .Values.app.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: expense-tracker
  template:
    metadata:
      labels:
        app.kubernetes.io/name: expense-tracker
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: 5174
          env:
            - name: PORT
              value: "5174"
            - name: PUBLIC_URL
              value: {{ .Values.app.publicUrl | quote }}
            {{- include "expense-tracker.pgenv" . | nindent 12 }}
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: SESSION_SECRET
            - name: ALLOWED_EMAILS
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: ALLOWED_EMAILS
            {{- if .Values.auth.google.enabled }}
            - name: GOOGLE_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: GOOGLE_CLIENT_ID
            - name: GOOGLE_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: GOOGLE_CLIENT_SECRET
            {{- end }}
            {{- if .Values.auth.openbao.enabled }}
            - name: OPENBAO_ISSUER
              value: {{ .Values.auth.openbao.issuer | quote }}
            - name: OPENBAO_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: OPENBAO_CLIENT_ID
            - name: OPENBAO_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: expense-tracker-app
                  key: OPENBAO_CLIENT_SECRET
            # OpenBao's certificate is self-signed (cert-manager), so trust its CA.
            - name: NODE_EXTRA_CA_CERTS
              value: /etc/openbao-ca/openbao-ca.crt
            {{- end }}
          # The server starts listening only after Postgres answered and migrations ran.
          startupProbe:
            httpGet:
              path: /livez
              port: http
            periodSeconds: 3
            failureThreshold: 40
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            httpGet:
              path: /livez
              port: http
            periodSeconds: 20
            timeoutSeconds: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            {{- toYaml .Values.app.resources | nindent 12 }}
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            {{- if .Values.auth.openbao.enabled }}
            - name: openbao-ca
              mountPath: /etc/openbao-ca
              readOnly: true
            {{- end }}
      volumes:
        - name: tmp
          emptyDir: {}
        {{- if .Values.auth.openbao.enabled }}
        - name: openbao-ca
          secret:
            secretName: expense-tracker-app
            items:
              - key: openbao-ca.crt
                path: openbao-ca.crt
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
---
apiVersion: v1
kind: Service
metadata:
  name: expense-tracker
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  selector:
    app.kubernetes.io/name: expense-tracker
  ports:
    - name: http
      port: 80
      targetPort: http