apiVersion: apps/v1
kind: Deployment
metadata:
  name: eventyay-web
  namespace: {{ .namespace }}
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      nodeSelector:
        kubernetes.io/arch: amd64
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: eventyay
          image: eventyay/eventyay-next:main
          args: ["gunicorn", "eventyay.config.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "120"]
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
          env:
            - name: EVY_DEBUG
              value: "0"
            - name: EVY_RUNNING_ENVIRONMENT
              value: "production"
            - name: EVY_SITE_URL
              value: "https://{{ .domain }}"
            - name: EVY_TALK_HOSTNAME
              value: "https://{{ .domain }}"
            - name: EVY_ALLOWED_HOSTS
              value: '["{{ .domain }}"]'
            - name: EVY_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: djangoSecret
            - name: EVY_POSTGRES_DB
              value: "{{ .db.name }}"
            - name: EVY_POSTGRES_USER
              value: "{{ .db.user }}"
            - name: EVY_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: dbPassword
            - name: EVY_POSTGRES_HOST
              value: "{{ .db.host }}"
            - name: EVY_POSTGRES_PORT
              value: "{{ .db.port }}"
            - name: POSTGRES_DB
              value: "{{ .db.name }}"
            - name: POSTGRES_USER
              value: "{{ .db.user }}"
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: dbPassword
            - name: POSTGRES_HOST
              value: "{{ .db.host }}"
            - name: POSTGRES_PORT
              value: "{{ .db.port }}"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: redis.password
            - name: EVY_REDIS_URL
              value: "redis://:$(REDIS_PASSWORD)@{{ .redis.host }}:{{ .redis.port }}/0"
            - name: EVY_EMAIL_BACKEND
              value: "django.core.mail.backends.smtp.EmailBackend"
            - name: EVY_EMAIL_HOST
              value: "{{ .smtp.host }}"
            - name: EVY_EMAIL_PORT
              value: "{{ .smtp.port }}"
            - name: EVY_DEFAULT_FROM_EMAIL
              value: "{{ .smtp.from }}"
            - name: EVY_EMAIL_HOST_USER
              value: "{{ .smtp.user }}"
            - name: EVY_EMAIL_HOST_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: smtp.password
            - name: EVY_EMAIL_USE_TLS
              value: "1"
          resources:
            limits:
              cpu: "2"
              ephemeral-storage: 2Gi
              memory: 1Gi
            requests:
              cpu: 50m
              ephemeral-storage: 100Mi
              memory: 256Mi
          volumeMounts:
            - name: eventyay-data
              mountPath: /data
            - name: eventyay-static
              mountPath: /home/app/web/eventyay/static.dist
            - name: eventyay-gunicorn
              mountPath: /home/app/.gunicorn
          livenessProbe:
            httpGet:
              path: /static/pretixbase/img/eventyay-icon.svg
              port: 8080
            initialDelaySeconds: 120
            timeoutSeconds: 10
            periodSeconds: 30
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /static/pretixbase/img/eventyay-icon.svg
              port: 8080
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 15
            failureThreshold: 3
        - name: nginx
          image: nginxinc/nginx-unprivileged:1.27-alpine
          ports:
            - name: nginx-http
              containerPort: 8080
              protocol: TCP
          volumeMounts:
            - name: eventyay-static
              mountPath: /static
              readOnly: true
            - name: nginx-config
              mountPath: /etc/nginx/conf.d
              readOnly: true
          resources:
            limits:
              cpu: 200m
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 32Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
            readOnlyRootFilesystem: false
      volumes:
        - name: eventyay-data
          persistentVolumeClaim:
            claimName: eventyay-data
        - name: eventyay-static
          emptyDir: {}
        - name: eventyay-gunicorn
          emptyDir: {}
        - name: nginx-config
          configMap:
            name: eventyay-nginx
      restartPolicy: Always
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: eventyay-worker
  namespace: {{ .namespace }}
spec:
  replicas: 1
  selector:
    matchLabels:
      component: worker
  template:
    metadata:
      labels:
        component: worker
    spec:
      nodeSelector:
        kubernetes.io/arch: amd64
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: eventyay-worker
          image: eventyay/eventyay-next:main
          command: ["celery", "-A", "eventyay", "worker", "-l", "info"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
          env:
            - name: EVY_DEBUG
              value: "0"
            - name: EVY_RUNNING_ENVIRONMENT
              value: "production"
            - name: EVY_SITE_URL
              value: "https://{{ .domain }}"
            - name: EVY_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: djangoSecret
            - name: EVY_POSTGRES_DB
              value: "{{ .db.name }}"
            - name: EVY_POSTGRES_USER
              value: "{{ .db.user }}"
            - name: EVY_POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: dbPassword
            - name: EVY_POSTGRES_HOST
              value: "{{ .db.host }}"
            - name: EVY_POSTGRES_PORT
              value: "{{ .db.port }}"
            - name: POSTGRES_DB
              value: "{{ .db.name }}"
            - name: POSTGRES_USER
              value: "{{ .db.user }}"
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: dbPassword
            - name: POSTGRES_HOST
              value: "{{ .db.host }}"
            - name: POSTGRES_PORT
              value: "{{ .db.port }}"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: eventyay-secrets
                  key: redis.password
            - name: EVY_REDIS_URL
              value: "redis://:$(REDIS_PASSWORD)@{{ .redis.host }}:{{ .redis.port }}/0"
            - name: MPLCONFIGDIR
              value: "/tmp/matplotlib"
          resources:
            limits:
              cpu: "2"
              ephemeral-storage: 1Gi
              memory: 4Gi
            requests:
              cpu: 50m
              ephemeral-storage: 50Mi
              memory: 2Gi
      restartPolicy: Always