apiVersion: apps/v1
kind: Deployment
metadata:
  name: registration-acceptance-harness
  namespace: email-connect
  labels: &labels
    app.kubernetes.io/name: email-connect
    app.kubernetes.io/instance: registration-acceptance-harness
    app.kubernetes.io/component: test-mailbox
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: registration-acceptance-harness
  template:
    metadata:
      labels: *labels
    spec:
      automountServiceAccountToken: false
      securityContext:
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: email-connect
          image: forgejo.coulomb.social/coulomb/email-connect@sha256:daa4c764f565f6bad47efc3ae072af8ad482949d28c68fc251055758cebc594c
          ports: [{name: http, containerPort: 8082}]
          env:
            - {name: EMAIL_CONNECT_DATABASE_PATH, value: /data/email-connect.db}
            - {name: EMAIL_CONNECT_HTTP_PORT, value: "8082"}
            - {name: EMAIL_CONNECT_INGEST_TOKEN, value: harness-ingest-token}
            - {name: EMAIL_CONNECT_SMTP_HOST, value: 127.0.0.1}
            - {name: EMAIL_CONNECT_SMTP_PORT, value: "3025"}
            - {name: EMAIL_CONNECT_SMTP_SECURITY, value: plaintext}
            - {name: EMAIL_CONNECT_SMTP_USERNAME, value: harness}
            - {name: EMAIL_CONNECT_SMTP_PASSWORD, value: harness}
            - {name: EMAIL_CONNECT_SENDER, value: noreply@harness.email-connect.test}
            - {name: EMAIL_CONNECT_PORTAL_URL, value: "https://users.92-205-62-239.nip.io"}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 10001
            runAsGroup: 10001
          volumeMounts:
            - {name: data, mountPath: /data}
            - {name: tmp, mountPath: /tmp}
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 3
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: 250m, memory: 256Mi}
        - name: greenmail
          image: greenmail/standalone:2.1.12@sha256:9f32971b4f25d32b4de6fa2e297423768441c65e4541f6aecd7631c890a229a7
          env:
            - name: GREENMAIL_OPTS
              value: >-
                -Dgreenmail.setup.test.smtp -Dgreenmail.setup.test.imap
                -Dgreenmail.hostname=127.0.0.1 -Dgreenmail.auth.disabled
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
          readinessProbe:
            exec:
              command: ["bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/3025 && exec 4<>/dev/tcp/127.0.0.1/3143"]
            periodSeconds: 3
          resources:
            requests: {cpu: 25m, memory: 96Mi}
            limits: {cpu: 250m, memory: 256Mi}
      volumes:
        - {name: data, emptyDir: {}}
        - {name: tmp, emptyDir: {}}
---
apiVersion: v1
kind: Service
metadata:
  name: registration-acceptance-harness
  namespace: email-connect
spec:
  selector:
    app.kubernetes.io/instance: registration-acceptance-harness
  ports: [{name: http, port: 8080, targetPort: http}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: registration-acceptance-harness
  namespace: email-connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: registration-acceptance-harness
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: user-engine}
          podSelector:
            matchLabels: {app.kubernetes.io/name: user-engine}
      ports: [{protocol: TCP, port: 8082}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: registration-acceptance-harness-egress
  namespace: user-engine
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: user-engine
  policyTypes: [Egress]
  egress:
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: email-connect}
          podSelector:
            matchLabels:
              app.kubernetes.io/instance: registration-acceptance-harness
      ports: [{protocol: TCP, port: 8082}]