# SWS (Static Web Server) serves an image containing only committed Packwiz
# files. There is no writable volume to drift from Git and no database to back
# up; publishing a new image is the complete deployment operation.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mcpacks
  namespace: mcpacks
spec:
  # Two copies allow one Pod to keep serving Minecraft clients while the other
  # is replaced during an image rollout or rescheduled after a node failure.
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      app: mcpacks
  template:
    metadata:
      labels:
        app: mcpacks
    spec:
      # SWS only reads files from its image and never calls the Kubernetes API,
      # so do not inject the namespace's default API credential into its Pods.
      automountServiceAccountToken: false
      # Keep normal replica placement balanced across nodes. maxSkew 1 still
      # permits one temporary surge Pod during a zero-downtime rollout; strict
      # anti-affinity would deadlock that rollout when only two workers exist.
      # Honor excludes the tainted control-plane nodes from the skew calculation;
      # counting nodes this Pod cannot use would make the surge unschedulable.
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          nodeTaintsPolicy: Honor
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: mcpacks
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: mcpacks
          # The publishing workflow replaces this bootstrap tag with an
          # immutable OCI digest. Never deploy the mutable latest tag after
          # bootstrap: recording the digest makes rollbacks and audits reliable.
          image: tea.ahmza.com/ahmza.com/mcpacks-site@sha256:a81995d3de2d4644cd01a907018607d4e1015afc2fa91aba6898529b451b4057
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            # The upstream image does not declare USER itself. Set an explicit
            # unprivileged identity so runAsNonRoot is enforceable rather than
            # causing Kubernetes to reject the container as potentially root.
            runAsUser: 10001
            runAsGroup: 10001
            capabilities:
              drop:
                - ALL
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 2
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 30
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              cpu: 250m
              memory: 64Mi