apiVersion: apps/v1
kind: Deployment
metadata:
  name: collabora
  namespace: lasuite
spec:
  replicas: 1
  selector:
    matchLabels:
      app: collabora
  template:
    metadata:
      labels:
        app: collabora
    spec:
      containers:
        - name: collabora
          image: collabora/code:latest
          ports:
            - containerPort: 9980
          env:
            # Regex of allowed WOPI host origins (Drive's public URL). Escape the dot.
            - name: aliasgroup1
              value: "https://drive\\.DOMAIN_SUFFIX:443"
            # Public hostname — Collabora uses this in self-referencing URLs.
            - name: server_name
              value: "docs.DOMAIN_SUFFIX"
            # TLS terminated at Pingora. Production defaults for lang, UI, and perf.
            - name: extra_params
              value: >-
                --o:ssl.enable=false
                --o:ssl.termination=true
                --o:default_language=en_GB
                --o:user_interface.mode=tabbed
                --o:autosave_duration_secs=120
                --o:idlesave_duration_secs=15
                --o:num_prespawn_children=2
                --o:per_document.max_concurrency=4
                --o:logging.level=warning
            - name: dictionaries
              value: "en_GB en_US fr_FR nl_NL pt_PT de_DE es_ES it_IT pl_PL sv_SE da_DK nb_NO fi_FI el_GR cs_CZ ro_RO hu_HU bg_BG hr_HR sk_SK sl_SI et_EE lv_LV lt_LT"
            - name: username
              valueFrom:
                secretKeyRef:
                  name: collabora-credentials
                  key: username
            - name: password
              valueFrom:
                secretKeyRef:
                  name: collabora-credentials
                  key: password
          readinessProbe:
            httpGet:
              path: /hosting/discovery
              port: 9980
            initialDelaySeconds: 15
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /hosting/discovery
              port: 9980
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
          securityContext:
            capabilities:
              add:
                - SYS_CHROOT
                - SYS_ADMIN
          resources:
            limits:
              memory: 1Gi
              cpu: 1000m
            requests:
              memory: 512Mi
              cpu: 100m