apiVersion: apps/v1
kind: Deployment
metadata:
  name: zulip
  namespace: {{ .namespace }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      securityContext:
        runAsNonRoot: false
        runAsUser: 0
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: zulip
          image: zulip/docker-zulip:9.4-0
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          env:
            - name: SETTING_ZULIP_ADMINISTRATOR
              value: "{{ .adminEmail }}"
            - name: ZULIP_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: adminPassword
            - name: SETTING_EXTERNAL_HOST
              value: "{{ .domain }}"
            - name: SSL_CERTIFICATE_GENERATION
              value: "self-signed"
            - name: SECRETS_secret_key
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: secretKey
            # Database
            - name: DB_HOST
              value: "{{ .db.host }}"
            - name: DB_HOST_PORT
              value: "{{ .db.port }}"
            - name: DB_NAME
              value: "{{ .db.name }}"
            - name: DB_USER
              value: "{{ .db.user }}"
            - name: SECRETS_postgres_password
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: postgresPassword
            # RabbitMQ
            - name: SETTING_RABBITMQ_HOST
              value: "{{ .rabbitmq.host }}"
            - name: SETTING_RABBITMQ_USER
              value: "{{ .rabbitmq.user }}"
            - name: SECRETS_rabbitmq_password
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: rabbitmqPassword
            # Redis
            - name: SETTING_REDIS_HOST
              value: "{{ .redis.host }}"
            - name: SECRETS_redis_password
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: redis.password
            # Memcached
            - name: SETTING_MEMCACHED_LOCATION
              value: "{{ .memcached.host }}:11211"
            # Email
            - name: SETTING_EMAIL_HOST
              value: "{{ .smtp.host }}"
            - name: SETTING_EMAIL_HOST_USER
              value: "{{ .smtp.user }}"
            - name: SETTING_EMAIL_PORT
              value: "{{ .smtp.port }}"
            - name: SETTING_EMAIL_USE_TLS
              value: "True"
            - name: SETTING_EMAIL_BACKEND
              value: "django.core.mail.backends.smtp.EmailBackend"
            - name: SETTING_DEFAULT_FROM_EMAIL
              value: "{{ .smtp.from }}"
            - name: SECRETS_email_password
              valueFrom:
                secretKeyRef:
                  name: zulip-secrets
                  key: smtp.password
            # Reverse proxy configuration (Traefik terminates TLS)
            - name: DISABLE_HTTPS
              value: "true"
            - name: LOADBALANCER_IPS
              value: "10.244.0.0/16"
          resources:
            limits:
              cpu: "2"
              ephemeral-storage: 1Gi
              memory: 3Gi
            requests:
              cpu: 50m
              ephemeral-storage: 100Mi
              memory: 512Mi
          volumeMounts:
            - name: zulip-data
              mountPath: /data
          livenessProbe:
            httpGet:
              path: /accounts/home/
              port: 80
              httpHeaders:
                - name: Host
                  value: "{{ .domain }}"
            initialDelaySeconds: 180
            timeoutSeconds: 30
            periodSeconds: 30
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /accounts/home/
              port: 80
              httpHeaders:
                - name: Host
                  value: "{{ .domain }}"
            initialDelaySeconds: 120
            timeoutSeconds: 30
            periodSeconds: 15
            failureThreshold: 6
          securityContext:
            readOnlyRootFilesystem: false
      volumes:
        - name: zulip-data
          persistentVolumeClaim:
            claimName: zulip-data
      restartPolicy: Always