apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    io.kompose.service: serpbear
  name: serpbear
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: serpbear
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        io.kompose.service: serpbear
    spec:
      securityContext:
        fsGroup: 1001
      containers:
        - env:
            - name: USER
              valueFrom:
                secretKeyRef:
                  name: serpbear-secrets
                  key: user
            - name: PASSWORD
              valueFrom:
                secretKeyRef:
                  name: serpbear-secrets
                  key: password
            - name: SECRET
              valueFrom:
                secretKeyRef:
                  name: serpbear-secrets
                  key: secret
            - name: APIKEY
              valueFrom:
                secretKeyRef:
                  name: serpbear-secrets
                  key: apikey
            - name: NEXT_PUBLIC_APP_URL
              value: https://serpbear.rubenhensen.nl
            - name: TZ
              value: Europe/Amsterdam
            # Node trusts its built-in roots, which still include the ones
            # above the compromised eMudhra intermediates. Use
            # patched-ca-bundle through OpenSSL instead until Node ships a fix.
            - name: NODE_OPTIONS
              value: --use-openssl-ca
            - name: SSL_CERT_FILE
              value: /etc/ssl/certs/ca-certificates.crt
          image: towfiqi/serpbear:3.1.0
          name: serpbear
          ports:
            - containerPort: 3000
              protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 160Mi
            limits:
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /login
              port: 3000
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            tcpSocket:
              port: 3000
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 5
          volumeMounts:
            - mountPath: /app/data
              name: data
            - mountPath: /etc/ssl/certs
              name: patched-ca-bundle
              readOnly: true
      restartPolicy: Always
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: data
        - name: patched-ca-bundle
          configMap:
            name: patched-ca-bundle