---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rspamd
  namespace: mail
  annotations:
    reloader.stakater.com/auto: "true"
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: rspamd
  template:
    metadata:
      labels:
        app.kubernetes.io/name: rspamd
    spec:
      serviceAccountName: rspamd
      automountServiceAccountToken: false
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: rspamd
      securityContext:
        runAsNonRoot: true
        runAsUser: 11333
        runAsGroup: 11333
        fsGroup: 11333
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: rspamd
          image: docker.io/rspamd/rspamd:4.2.2
          imagePullPolicy: IfNotPresent
          env:
            - name: RSPAMD_LOCAL_ADDR
              value: "*"
            - name: RSPAMD_LOG_TYPE
              value: console
            - name: RSPAMD_LITELLM_API_KEY
              valueFrom:
                secretKeyRef:
                  name: rspamd-litellm
                  key: key
            - name: RSPAMD_CONTROLLER_PASSWORD_HASH
              valueFrom:
                secretKeyRef:
                  name: rspamd-controller
                  key: password_hash
          ports:
            - containerPort: 11332
              name: milter
              protocol: TCP
            - containerPort: 11334
              name: controller
              protocol: TCP
          readinessProbe:
            tcpSocket:
              port: milter
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /ping
              port: controller
            initialDelaySeconds: 60
            periodSeconds: 30
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 1536Mi
          volumeMounts:
            - name: config
              mountPath: /etc/rspamd/local.d
              readOnly: true
            - name: sa-rules
              mountPath: /etc/rspamd/sa-rules
              readOnly: true
            - name: dkim
              mountPath: /etc/rspamd/dkim
              readOnly: true
            - name: data
              mountPath: /var/lib/rspamd
      volumes:
        - name: config
          configMap:
            name: rspamd-config
        - name: sa-rules
          configMap:
            name: rspamd-sa-rules
        - name: dkim
          secret:
            secretName: dkim-unkin-net
            defaultMode: 0440
            items:
              - key: private_key
                path: unkin.net.mail.key
        - name: data
          emptyDir: {}
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: rspamd
  namespace: mail
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: rspamd
---
# Milter for the smarthost only (rspamd.mail.svc:11332); controller/web UI is in-cluster only.
apiVersion: v1
kind: Service
metadata:
  name: rspamd
  namespace: mail
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: rspamd
  ports:
    - name: milter
      port: 11332
      targetPort: milter
    - name: controller
      port: 11334
      targetPort: controller