apiVersion: apps/v1
kind: Deployment
metadata:
  name: issue-core
  namespace: issue-core
  labels:
    app.kubernetes.io/name: issue-core
    app.kubernetes.io/part-of: railiance-gitops
  annotations:
    argocd.argoproj.io/sync-wave: "1"  # after the ExternalSecret (wave 0)
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: issue-core
  template:
    metadata:
      labels:
        app.kubernetes.io/name: issue-core
        app.kubernetes.io/part-of: railiance-gitops
    spec:
      # Image is public-pullable from the Gitea registry (per railiance-forge
      # docs). Add imagePullSecrets: [{name: gitea-registry}] if it becomes private.
      containers:
        - name: issue-core
          image: gitea.coulomb.social/coulomb/issue-core:0.2.0
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8765
          env:
            - name: ISSUE_CORE_API_KEY
              valueFrom:
                secretKeyRef:
                  name: issue-core-runtime
                  key: ISSUE_CORE_API_KEY
            - name: GITEA_BACKEND_TOKEN
              valueFrom:
                secretKeyRef:
                  name: issue-core-runtime
                  key: GITEA_BACKEND_TOKEN
            - name: BACKENDS_TEMPLATE
              valueFrom:
                configMapKeyRef:
                  name: issue-core-backends
                  key: backends.json
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 10
            periodSeconds: 20
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            capabilities:
              drop: ["ALL"]