# services/comms/mas-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: matrix-authentication-service
  labels:
    app: matrix-authentication-service
spec:
  replicas: 1
  selector:
    matchLabels:
      app: matrix-authentication-service
  template:
    metadata:
      annotations:
        checksum/config: v5-adminapi-6
      labels:
        app: matrix-authentication-service
    spec:
      enableServiceLinks: false
      nodeSelector:
        hardware: rpi5
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 50
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: ["rpi5","rpi4"]
      initContainers:
        - name: render-config
          image: alpine:3.20
          command: ["/bin/sh","-c"]
          args:
            - |
              set -euo pipefail
              umask 077
              DB_PASS_ESCAPED="$(printf '%s' "${MAS_DB_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
              MATRIX_SECRET_ESCAPED="$(printf '%s' "${MATRIX_SHARED_SECRET}" | sed 's/[\\/&]/\\&/g')"
              KC_SECRET_ESCAPED="$(printf '%s' "${KEYCLOAK_CLIENT_SECRET}" | sed 's/[\\/&]/\\&/g')"

              sed \
                -e "s/@@MAS_DB_PASSWORD@@/${DB_PASS_ESCAPED}/g" \
                -e "s/@@MATRIX_SHARED_SECRET@@/${MATRIX_SECRET_ESCAPED}/g" \
                -e "s/@@KEYCLOAK_CLIENT_SECRET@@/${KC_SECRET_ESCAPED}/g" \
                /etc/mas/config.yaml > /rendered/config.yaml
              chmod 0644 /rendered/config.yaml
          env:
            - name: MAS_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mas-db
                  key: password
            - name: MATRIX_SHARED_SECRET
              valueFrom:
                secretKeyRef:
                  name: mas-secrets-runtime
                  key: matrix_shared_secret
            - name: KEYCLOAK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: mas-secrets-runtime
                  key: keycloak_client_secret
          volumeMounts:
            - name: config
              mountPath: /etc/mas/config.yaml
              subPath: config.yaml
              readOnly: true
            - name: rendered
              mountPath: /rendered
              readOnly: false
      containers:
        - name: mas
          image: ghcr.io/element-hq/matrix-authentication-service:1.8.0
          args: ["server","--config","/rendered/config.yaml"]
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
            - name: internal
              containerPort: 8081
              protocol: TCP
          volumeMounts:
            - name: rendered
              mountPath: /rendered
              readOnly: true
            - name: secrets
              mountPath: /etc/mas/secrets
              readOnly: true
            - name: admin-client
              mountPath: /etc/mas/admin-client
              readOnly: true
            - name: keys
              mountPath: /etc/mas/keys
              readOnly: true
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              cpu: "2"
              memory: 1Gi
      volumes:
        - name: config
          configMap:
            name: matrix-authentication-service-config
            items:
              - key: config.yaml
                path: config.yaml
        - name: rendered
          emptyDir: {}
        - name: secrets
          secret:
            secretName: mas-secrets-runtime
            items:
              - key: encryption
                path: encryption
              - key: matrix_shared_secret
                path: matrix_shared_secret
              - key: keycloak_client_secret
                path: keycloak_client_secret
        - name: keys
          secret:
            secretName: mas-secrets-runtime
            items:
              - key: rsa_key
                path: rsa_key
        - name: admin-client
          secret:
            secretName: mas-admin-client-runtime
            items:
              - key: client_secret
                path: client_secret
---
apiVersion: v1
kind: Service
metadata:
  name: matrix-authentication-service
spec:
  selector:
    app: matrix-authentication-service
  ports:
    - name: http
      port: 8080
      targetPort: http
      protocol: TCP
    - name: internal
      port: 8081
      targetPort: internal
      protocol: TCP