# Static page plus numeric-only receipts; no media, installed credentials or egress.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lesavka-av-observer
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels: {app: lesavka-av-observer}
  template:
    metadata:
      labels: {app: lesavka-av-observer}
    spec:
      automountServiceAccountToken: false
      nodeSelector:
        kubernetes.io/arch: arm64
        node-role.kubernetes.io/worker: "true"
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        fsGroup: 101
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: static
          image: nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
          command: [/usr/sbin/nginx]
          args: [-c, /etc/nginx/observer/nginx.conf, -g, "daemon off;"]
          ports: [{name: http, containerPort: 8080}]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 10m, memory: 16Mi}
            limits: {cpu: 100m, memory: 64Mi}
          readinessProbe:
            httpGet: {path: /av-test/, port: http}
          livenessProbe:
            httpGet: {path: /av-test/, port: http}
            initialDelaySeconds: 10
          volumeMounts:
            - {name: config, mountPath: /etc/nginx/observer, readOnly: true}
            - {name: assets, mountPath: /usr/share/nginx/html/av-test, readOnly: true}
            - {name: tmp, mountPath: /tmp}
        - name: receipts
          image: python:3.13-slim@sha256:9662417aace5ae7b8e2609cce472b72a8958e134ba372808abe9cc1a0c0125e6
          command: [python, -u, -B, /app/server.py]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          resources:
            requests: {cpu: 10m, memory: 16Mi}
            limits: {cpu: 100m, memory: 64Mi}
          readinessProbe:
            exec:
              command: [python, -c, "import socket; socket.create_connection(('127.0.0.1', 8081), 2).close()"]
            # Starting an interpreter under the ARM CPU quota can exceed the
            # default one-second exec timeout, even when the listener is healthy.
            timeoutSeconds: 5
            periodSeconds: 15
          volumeMounts:
            - {name: receipts, mountPath: /app, readOnly: true}
      volumes:
        - name: config
          configMap: {name: lesavka-av-observer-nginx}
        - name: assets
          configMap: {name: lesavka-av-observer-assets}
        - name: tmp
          emptyDir: {medium: Memory, sizeLimit: 8Mi}
        - name: receipts
          configMap: {name: lesavka-av-observer-receipts}