apiVersion: apps/v1
kind: Deployment
metadata:
  name: cryptpad
  namespace: cryptpad
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      securityContext:
        runAsUser: 0
        runAsNonRoot: false
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: seed-config
          image: cryptpad/cryptpad:version-2026.5.1
          command:
            - sh
            - -c
            - |
              if [ ! -f /config-dest/config.example.js ]; then
                cp /cryptpad/config/config.example.js /config-dest/config.example.js
              fi
          volumeMounts:
            - name: cryptpad-config
              mountPath: /config-dest
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
            seccompProfile:
              type: RuntimeDefault
      containers:
        - name: cryptpad
          image: cryptpad/cryptpad:version-2026.5.1
          ports:
            - name: http
              containerPort: 3000
              protocol: TCP
          env:
            - name: CPAD_CONF
              value: /cryptpad/config/config.js
            - name: CPAD_MAIN_DOMAIN
              value: https://{{ .domain }}
            - name: CPAD_SANDBOX_DOMAIN
              value: https://{{ .sandboxDomain }}
            - name: CPAD_TRUSTED_PROXY
              value: "true"
          resources:
            limits:
              cpu: 1000m
              ephemeral-storage: 1Gi
              memory: 1Gi
            requests:
              cpu: 50m
              ephemeral-storage: 50Mi
              memory: 256Mi
          volumeMounts:
            - name: cryptpad-data
              mountPath: /cryptpad/data
            - name: cryptpad-config
              mountPath: /cryptpad/config
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 90
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 60
            timeoutSeconds: 3
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            runAsNonRoot: false
            runAsUser: 0
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
            seccompProfile:
              type: RuntimeDefault
      volumes:
        - name: cryptpad-data
          persistentVolumeClaim:
            claimName: cryptpad-data
        - name: cryptpad-config
          emptyDir: {}
      restartPolicy: Always