apiVersion: apps/v1
kind: Deployment
metadata:
    name: probely-onprem-agent
spec:
  replicas: 1
  selector:
    matchLabels:
      app: probely-onprem-agent
  template:
    metadata:
      labels:
        app: probely-onprem-agent
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: probely-onprem-agent
              topologyKey: kubernetes.io/hostname
      containers:
      - name: gateway
        image: probely/farcaster-onprem-agent:latest
        command:
        - /busybox/sh
        - /farcaster/bin/start-gateway.sh
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 250m
            memory: 128Mi
        securityContext:
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
            add:
            - NET_ADMIN
            - NET_RAW
            - SETUID
            - SETGID
        volumeMounts:
        - name: gateway-run
          mountPath: /run
        - name: farcaster-gateway-secrets
          mountPath: /secrets/farcaster/data
          readOnly: true
      - name: tunnel
        image: probely/farcaster-onprem-agent:latest
        command:
        - /busybox/sh
        - /farcaster/bin/start-tunnel.sh
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 250m
            memory: 128Mi
        securityContext:
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
            add:
            - NET_ADMIN
        volumeMounts:
        - name: tunnel-run
          mountPath: /run
        - name: farcaster-tunnel-secrets
          mountPath: /secrets/farcaster/data
          readOnly: true

      volumes:
      - name: tunnel-run
        emptyDir:
          medium: Memory
          sizeLimit: 5Mi
      - name: gateway-run
        emptyDir:
          medium: Memory
          sizeLimit: 5Mi
      - name: farcaster-tunnel-secrets
        secret:
          secretName: farcaster-tunnel-secrets
          defaultMode: 256
      - name: farcaster-gateway-secrets
        secret:
          secretName: farcaster-gateway-secrets
          defaultMode: 256
      terminationGracePeriodSeconds: 30
  minReadySeconds: 2
