# services/hermes/oauth-session-store.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: hermes-oauth-sessions-data
  namespace: hermes
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: astreae
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: hermes-oauth-sessions
  namespace: hermes
spec:
  selector:
    app: hermes-oauth-sessions
  ports:
    - {name: redis, port: 6379, targetPort: redis}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hermes-oauth-sessions
  namespace: hermes
  labels:
    app: hermes-oauth-sessions
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: hermes-oauth-sessions
  template:
    metadata:
      labels:
        app: hermes-oauth-sessions
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/worker
                    operator: In
                    values: ["true"]
                  - key: hardware
                    operator: In
                    values: [rpi4, rpi5]
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: [rpi5]
            - weight: 50
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: [rpi4]
      securityContext:
        fsGroup: 999
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: redis
          image: redis:7.4.1-alpine@sha256:c1e88455c85225310bbea54816e9c3f4b5295815e6dbf80c34d40afc6df28275
          args: [redis-server, --appendonly, "yes", --appendfsync, everysec, --save, "60", "1"]
          ports:
            - {name: redis, containerPort: 6379}
          readinessProbe:
            exec: {command: [redis-cli, ping]}
            initialDelaySeconds: 3
            periodSeconds: 5
          livenessProbe:
            exec: {command: [redis-cli, ping]}
            initialDelaySeconds: 15
            periodSeconds: 15
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            runAsNonRoot: true
            runAsUser: 999
            runAsGroup: 999
            seccompProfile:
              type: RuntimeDefault
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: 250m, memory: 256Mi}
          volumeMounts:
            - {name: data, mountPath: /data}
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: hermes-oauth-sessions-data
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-oauth-sessions
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-oauth-sessions
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values:
                  - hermes-agent
                  - oauth2-proxy-hermes-chat
                  - oauth2-proxy-hermes-triage
      ports:
        - {protocol: TCP, port: 6379}
  egress: []