# Planka-based Kanban project management — single container (SPA bundled into Sails backend).
# Image: src.DOMAIN_SUFFIX/studio/projects:latest
#   Built from projects/Dockerfile
#
# Secrets injected via env vars:
#   - projects-db-url (VaultDynamicSecret): DATABASE_URL
#   - projects-app-secrets (VaultStaticSecret): SECRET_KEY
#   - oidc-projects (Hydra Maester): CLIENT_ID, CLIENT_SECRET
#   - seaweedfs-s3-credentials (VaultStaticSecret): S3_ACCESS_KEY, S3_SECRET_KEY
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: projects
  namespace: lasuite
spec:
  replicas: 1
  selector:
    matchLabels:
      app: projects
  template:
    metadata:
      labels:
        app: projects
    spec:
      initContainers:
        - name: db-migrate
          image: projects
          command: ["node", "db/init.js"]
          envFrom:
            - configMapRef:
                name: projects-config
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: projects-db-url
                  key: url
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: projects-app-secrets
                  key: SECRET_KEY
          resources:
            limits:
              memory: 256Mi
            requests:
              memory: 128Mi
              cpu: 50m
      containers:
        - name: projects
          image: projects
          command: ["node", "app.js", "--prod"]
          ports:
            - name: http
              containerPort: 1337
          envFrom:
            - configMapRef:
                name: projects-config
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: projects-db-url
                  key: url
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: projects-app-secrets
                  key: SECRET_KEY
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: oidc-projects
                  key: CLIENT_ID
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: oidc-projects
                  key: CLIENT_SECRET
            - name: S3_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: seaweedfs-s3-credentials
                  key: S3_ACCESS_KEY
            - name: S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: seaweedfs-s3-credentials
                  key: S3_SECRET_KEY
          resources:
            limits:
              memory: 512Mi
            requests:
              memory: 256Mi
              cpu: 50m
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 15
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: projects
  namespace: lasuite
spec:
  selector:
    app: projects
  ports:
    - name: http
      port: 80
      targetPort: 1337