apiVersion: apps/v1
kind: Deployment
metadata:
  name: kaneo
  namespace: kaneo
  labels:
    app: kaneo
    component: app
spec:
  replicas: 0
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: kaneo
      component: app
  template:
    metadata:
      labels:
        app: kaneo
        component: app
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: csi.hetzner.cloud/location
                operator: In
                values:
                - fsn1
      initContainers:
      - name: wait-for-postgres
        image: postgres:16-alpine
        command:
        - sh
        - -c
        - |
          until pg_isready -h kaneo-postgres -U kaneo -d kaneo; do
            echo "Waiting for PostgreSQL..."
            sleep 2
          done
      containers:
      - name: kaneo
        image: ghcr.io/usekaneo/kaneo:2.22.0
        ports:
        - name: http
          containerPort: 5173
        env:
        # Public URL of this Kaneo instance.
        - name: KANEO_CLIENT_URL
          value: https://kaneo.basicstack.de
        - name: CORS_ORIGINS
          value: https://kaneo.basicstack.de
        # Better Auth JWT secret (>=32 chars).
        - name: AUTH_SECRET
          valueFrom:
            secretKeyRef:
              name: kaneo-app-secrets
              key: auth-secret
        # Database credentials. DATABASE_URL is preferred; POSTGRES_* are
        # accepted as a fallback and useful for the built-in migrations.
        - name: POSTGRES_DB
          value: kaneo
        - name: POSTGRES_USER
          value: kaneo
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: kaneo-db-credentials
              key: postgres-password
        - name: POSTGRES_HOST
          value: kaneo-postgres
        - name: POSTGRES_PORT
          value: "5432"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: kaneo-db-credentials
              key: database-url
        # Self-hosted: keep public registration off, log in via OIDC only.
        - name: DISABLE_REGISTRATION
          value: "true"
        - name: DISABLE_PASSWORD_REGISTRATION
          value: "true"
        - name: DISABLE_EMAIL_OTP_SIGN_IN
          value: "true"
        - name: KANEO_CLOUD
          value: "false"
        # Custom OAuth / OIDC via Pocket ID.
        - name: CUSTOM_OAUTH_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: kaneo-oidc-secret
              key: client-id
        - name: CUSTOM_OAUTH_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: kaneo-oidc-secret
              key: client-secret
        - name: CUSTOM_OAUTH_DISCOVERY_URL
          value: https://auth.basicstack.de/.well-known/openid-configuration
        - name: CUSTOM_OAUTH_AUTHORIZATION_URL
          value: https://auth.basicstack.de/authorize
        - name: CUSTOM_OAUTH_TOKEN_URL
          value: https://auth.basicstack.de/api/oidc/token
        - name: CUSTOM_OAUTH_USER_INFO_URL
          value: https://auth.basicstack.de/api/oidc/userinfo
        - name: CUSTOM_OAUTH_LOGOUT_URL
          value: https://auth.basicstack.de/api/oidc/end-session
        - name: CUSTOM_OAUTH_SCOPES
          value: openid,profile,email,groups
        - name: CUSTOM_AUTH_PKCE
          value: "true"
        # SMTP: outbound only, used for workspace invites / notifications.
        # Sign-in still requires OIDC (DISABLE_EMAIL_OTP_SIGN_IN=true above).
        - name: SMTP_HOST
          value: mail.basicstack.de
        - name: SMTP_PORT
          value: "587"
        - name: SMTP_SECURE
          value: "false"
        - name: SMTP_REQUIRE_TLS
          value: "true"
        - name: SMTP_USER
          valueFrom:
            secretKeyRef:
              name: kaneo-smtp
              key: smtp-user
        - name: SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: kaneo-smtp
              key: smtp-password
        - name: SMTP_FROM
          value: "Kaneo <kaneo@basicstack.de>"
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: "1"
            memory: 1Gi
        livenessProbe:
          httpGet:
            path: /api/health
            port: http
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /api/health
            port: http
          initialDelaySeconds: 15
          periodSeconds: 5
          timeoutSeconds: 3