apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ taskserv.name }}
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.name }}
    app.kubernetes.io/managed-by: provisioning
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ taskserv.name }}
  template:
    metadata:
      labels:
        app.kubernetes.io/name: {{ taskserv.name }}
        app.kubernetes.io/managed-by: provisioning
    spec:
      nodeSelector:
        kubernetes.io/hostname: {{ taskserv.node }}
      terminationGracePeriodSeconds: 60
      serviceAccountName: docker-mailserver
      containers:
        - name: docker-mailserver
          image: {{ taskserv.image }}
          ports:
            - containerPort: {{ taskserv.smtp_port }}
              name: smtp
              protocol: TCP
            - containerPort: {{ taskserv.imap_port }}
              name: imap
              protocol: TCP
            - containerPort: {{ taskserv.smtps_port }}
              name: smtps
              protocol: TCP
            - containerPort: {{ taskserv.submission_port }}
              name: submission
              protocol: TCP
            - containerPort: {{ taskserv.imaps_port }}
              name: imaps
              protocol: TCP
{% if taskserv.enable_pop3 == "1" %}
            - containerPort: {{ taskserv.pop3s_port }}
              name: pop3s
              protocol: TCP
{% endif %}
          envFrom:
            - configMapRef:
                name: {{ taskserv.name }}-env
            - secretRef:
                name: {{ taskserv.name }}-credentials
          volumeMounts:
            - name: mail-data
              mountPath: /var/mail
              subPath: data
            - name: mail-data
              mountPath: /var/mail-state
              subPath: state
            - name: mail-data
              mountPath: /var/log/mail
              subPath: log
            - name: mail-data
              mountPath: /tmp/docker-mailserver
              subPath: config
            - name: tls
              mountPath: /etc/ssl/mail
              readOnly: true
          readinessProbe:
            exec:
              command: ["sh", "-c", "kill -0 $(cat /var/spool/postfix/pid/master.pid)"]
            initialDelaySeconds: 20
            periodSeconds: 10
          livenessProbe:
            exec:
              command: ["sh", "-c", "kill -0 $(cat /var/spool/postfix/pid/master.pid)"]
            initialDelaySeconds: 90
            periodSeconds: 20
          resources:
            requests:
              cpu: "600m"
              memory: "2Gi"
            limits:
              memory: "4Gi"
              cpu: "1500m"
          securityContext:
            allowPrivilegeEscalation: true
            readOnlyRootFilesystem: false
            runAsUser: 0
            runAsGroup: 0
            runAsNonRoot: false
            privileged: false
            capabilities:
              add:
                - CHOWN
                - FOWNER
                - MKNOD
                - SETGID
                - SETUID
                - DAC_OVERRIDE
                - NET_ADMIN
                - NET_RAW
                - NET_BIND_SERVICE
                - SYS_CHROOT
                - KILL
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault

        - name: dms-gui
          image: {{ taskserv.gui_image }}
          ports:
            - containerPort: 80
              name: http
              protocol: TCP
          volumeMounts:
            - name: mail-data
              mountPath: /tmp/docker-mailserver
              subPath: config
            - name: mail-data
              mountPath: /app/config
              subPath: config/dms-gui
          resources:
            requests:
              cpu: "10m"
              memory: "32Mi"
            limits:
              memory: "128Mi"

{% if taskserv.dkim_publisher_enabled is defined and taskserv.dkim_publisher_enabled and taskserv.dns_records is defined %}
        - name: dkim-publisher
          image: bitnami/kubectl:latest
          command: ["/bin/bash", "/scripts/dkim-publish.sh"]
          args:
            - "{{ taskserv.dns_records.domain }}"
            - "{{ taskserv.dns_records.dkim_selector }}"
            - "{{ taskserv.namespace }}"
          # opendkim writes keys as root with mode 0640 (root:opendkim). The sidecar
          # mounts the PVC read-only, so it just needs to be the same UID as the
          # writer to read mail.txt. Run as root — kubectl is fine as root.
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            runAsNonRoot: false
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: mail-data
              mountPath: /tmp/docker-mailserver
              subPath: config
              readOnly: true
            - name: dkim-publisher-script
              mountPath: /scripts
          resources:
            requests:
              cpu: "5m"
              memory: "64Mi"
            limits:
              memory: "128Mi"
{% endif %}

      volumes:
        - name: mail-data
          persistentVolumeClaim:
            claimName: {{ taskserv.name }}-mail-data
        - name: tls
          secret:
            secretName: {{ taskserv.tls_secret }}
{% if taskserv.dkim_publisher_enabled is defined and taskserv.dkim_publisher_enabled and taskserv.dns_records is defined %}
        - name: dkim-publisher-script
          configMap:
            name: dkim-publisher-script
            defaultMode: 0755
{% endif %}