apiVersion: apps/v1
kind: Deployment
metadata:
  name: aptly
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: server
  template:
    metadata:
      labels:
        component: server
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: init-gpg
          image: urpylka/aptly:1.6.2
          command:
            - sh
            - -c
            - |
              export GNUPGHOME=/opt/aptly/gpg
              mkdir -p "$GNUPGHOME" /opt/aptly/public
              chmod 700 "$GNUPGHOME"
              if gpg --list-secret-keys 2>/dev/null | grep -q '^sec'; then
                echo "GPG key already exists, skipping"
              else
                echo "Generating GPG signing key..."
                printf '%%no-protection\nKey-Type: RSA\nKey-Length: 4096\nName-Real: Wild Cloud APT Repository\nName-Email: {{ .operatorEmail }}\nExpire-Date: 0\n%%commit\n' | gpg --batch --gen-key
                echo "GPG key generated"
              fi
              gpg --export --armor > /opt/aptly/public/public.key
          securityContext:
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: data
              mountPath: /opt/aptly
        - name: init-htpasswd
          image: httpd:alpine
          command:
            - sh
            - -c
            - htpasswd -bc /opt/aptly/api.htpasswd "$API_USER" "$API_PASSWORD"
          env:
            - name: API_USER
              value: "{{ .apiUser }}"
            - name: API_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: aptly-secrets
                  key: apiPassword
          securityContext:
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: data
              mountPath: /opt/aptly
      containers:
        - name: aptly
          image: urpylka/aptly:1.6.2
          ports:
            - containerPort: 80
              name: http
            - containerPort: 8080
              name: api
          securityContext:
            allowPrivilegeEscalation: false
          volumeMounts:
            - name: data
              mountPath: /opt/aptly
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: aptly-pvc