apiVersion: apps/v1
kind: Deployment
metadata:
  name: passbolt
  namespace: passbolt
spec:
  replicas: 1
  selector:
    matchLabels:
      app: passbolt
  template:
    metadata:
      labels:
        app: passbolt
    spec:
      securityContext:
        fsGroup: 33
      initContainers:
        - name: fix-permissions
          image: busybox:latest
          command:
            - sh
            - -c
            - |
              chown -R 33:33 /passbolt-data
              chmod -R 755 /passbolt-data
              mkdir -p /passbolt-data/gpg /passbolt-data/jwt /passbolt-data/tmp
              chown -R 33:33 /passbolt-data/gpg /passbolt-data/jwt /passbolt-data/tmp
              chmod 700 /passbolt-data/gpg /passbolt-data/jwt
          volumeMounts:
            - name: passbolt-data
              mountPath: /passbolt-data
      containers:
        - name: passbolt
          image: passbolt/passbolt:latest-ce
          ports:
            - containerPort: 80
              name: http
            - containerPort: 443
              name: https
          env:
            - name: DATASOURCES_DEFAULT_HOST
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: DATASOURCES_DEFAULT_HOST
            - name: DATASOURCES_DEFAULT_USERNAME
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: DATASOURCES_DEFAULT_USERNAME
            - name: DATASOURCES_DEFAULT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: DATASOURCES_DEFAULT_PASSWORD
            - name: DATASOURCES_DEFAULT_DATABASE
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: DATASOURCES_DEFAULT_DATABASE
            - name: APP_FULL_BASE_URL
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: APP_FULL_BASE_URL
            - name: PASSBOLT_JWT_SERVER_EXPONENT
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: PASSBOLT_JWT_SERVER_EXPONENT
            - name: EMAIL_TRANSPORT_DEFAULT_HOST
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_TRANSPORT_DEFAULT_HOST
            - name: EMAIL_TRANSPORT_DEFAULT_PORT
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_TRANSPORT_DEFAULT_PORT
            - name: EMAIL_TRANSPORT_DEFAULT_TLS
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_TRANSPORT_DEFAULT_TLS
            - name: EMAIL_TRANSPORT_DEFAULT_USERNAME
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_TRANSPORT_DEFAULT_USERNAME
            - name: EMAIL_TRANSPORT_DEFAULT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_TRANSPORT_DEFAULT_PASSWORD
            - name: EMAIL_DEFAULT_FROM
              valueFrom:
                secretKeyRef:
                  name: passbolt-secret
                  key: EMAIL_DEFAULT_FROM
          volumeMounts:
            - name: passbolt-data
              mountPath: /etc/passbolt/gpg
              subPath: gpg
            - name: passbolt-data
              mountPath: /etc/passbolt/jwt
              subPath: jwt
            - name: passbolt-data
              mountPath: /var/www/passbolt/tmp
              subPath: tmp
          livenessProbe:
            httpGet:
              path: /healthcheck/status.json
              port: 80
            initialDelaySeconds: 60
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthcheck/status.json
              port: 80
            initialDelaySeconds: 30
            periodSeconds: 5
      volumes:
        - name: passbolt-data
          persistentVolumeClaim:
            claimName: passbolt-data-pvc