---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: paperclip
  namespace: paperclip
spec:
  selector:
    matchLabels:
      app: paperclip
  template:
    metadata:
      labels:
        app: paperclip
    spec:
      containers:
        - name: paperclip
          image: ghcr.io/paperclipai/paperclip:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 3100
              name: http
              protocol: TCP
          env:
            - name: PORT
              value: "3100"
            - name: PAPERCLIP_BIND
              value: custom
            - name: PAPERCLIP_BIND_HOST
              value: 0.0.0.0
            - name: PAPERCLIP_API_URL
              value: https://paperclip.k8s.syd1.au.unkin.net
            - name: BETTER_AUTH_BASE_URL
              value: https://paperclip.k8s.syd1.au.unkin.net
            - name: PAPERCLIP_ALLOWED_HOSTNAMES
              value: paperclip.k8s.syd1.au.unkin.net,localhost
            - name: PAPERCLIP_HOME
              value: /paperclip
            - name: PAPERCLIP_INSTANCE_ID
              value: default
            - name: PAPERCLIP_DEPLOYMENT_MODE
              value: authenticated
            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
              value: private
            - name: SERVE_UI
              value: "true"
            - name: HEARTBEAT_SCHEDULER_ENABLED
              value: "true"
            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
              value: "true"
            - name: PAPERCLIP_STORAGE_PROVIDER
              value: s3
            - name: PAPERCLIP_STORAGE_S3_BUCKET
              value: paperclip
            - name: PAPERCLIP_STORAGE_S3_REGION
              value: us-east-1
            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
              value: https://radosgw.service.consul
            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
              value: "true"
            - name: NODE_EXTRA_CA_CERTS
              value: /etc/ssl/paperclip/ca.crt
          envFrom:
            - secretRef:
                name: paperclip-credentials
          volumeMounts:
            - name: vault-ca-cert
              mountPath: /etc/ssl/paperclip
              readOnly: true
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3100
              httpHeaders:
                - name: Host
                  value: localhost
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3100
              httpHeaders:
                - name: Host
                  value: localhost
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            limits:
              cpu: "1"
              memory: 2Gi
            requests:
              cpu: 250m
              memory: 512Mi
      volumes:
        - name: vault-ca-cert
          secret:
            secretName: vault-ca-cert
            items:
              - key: ca.crt
                path: ca.crt
      restartPolicy: Always
