apiVersion: v1
kind: Namespace
metadata:
  name: user-engine
  labels:
    railiance.io/workload-class: platform
---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: user-engine-pg
  namespace: user-engine
spec:
  instances: 1
  imageName: ghcr.io/cloudnative-pg/postgresql:17.5
  storage:
    size: 5Gi
  bootstrap:
    initdb:
      database: user_engine
      owner: user_engine
  resources:
    requests: {cpu: 100m, memory: 256Mi}
    limits: {cpu: "1", memory: 1Gi}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-engine
  namespace: user-engine
  labels: &labels
    app.kubernetes.io/name: user-engine
    app.kubernetes.io/component: portal
spec:
  replicas: 1
  selector:
    matchLabels: {app.kubernetes.io/name: user-engine}
  template:
    metadata:
      labels: *labels
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: portal
          image: forgejo.coulomb.social/coulomb/user-engine@sha256:ffca598fab9c035b58a40ae6c2be365497743a7594bc584124ab231383f25d8a
          imagePullPolicy: IfNotPresent
          ports: [{name: http, containerPort: 8080}]
          env:
            - name: USER_ENGINE_DATABASE_URL
              valueFrom:
                secretKeyRef: {name: user-engine-pg-app, key: uri}
            - name: USER_ENGINE_PROXY_SECRET
              valueFrom:
                secretKeyRef: {name: user-engine-runtime, key: proxy-secret}
            - {name: USER_ENGINE_LOGIN_URL, value: "https://kc.coulomb.social/"}
            - {name: USER_ENGINE_OIDC_ISSUER, value: "https://kc.coulomb.social"}
            - {name: USER_ENGINE_OIDC_AUDIENCE, value: user-engine-portal}
            - {name: USER_ENGINE_OIDC_CLIENT_ID, value: user-engine-portal}
            - {name: USER_ENGINE_OIDC_REDIRECT_URI, value: "https://users.92-205-62-239.nip.io/oidc/callback"}
            - {name: USER_ENGINE_OIDC_BACKEND_URL, value: "http://keycape.sso.svc.cluster.local:8080"}
            - {name: USER_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080"}
            - {name: USER_ENGINE_EVENT_URL, value: "http://audit-core.audit-core.svc.cluster.local:8080/v1/events"}
            - {name: USER_ENGINE_MAIL_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080/v1/send"}
            - name: USER_ENGINE_EVENT_TOKEN
              valueFrom:
                secretKeyRef: {name: user-engine-delivery, key: event-token}
            - name: USER_ENGINE_MAIL_TOKEN
              valueFrom:
                secretKeyRef: {name: user-engine-delivery, key: mail-token}
            - {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "false"}
            - {name: USER_ENGINE_REGISTRATION_RATE_LIMIT, value: "10"}
            - {name: USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS, value: "60"}
            - {name: USER_ENGINE_PROVISIONING_URL, value: "http://identity-provisioner.sso.svc.cluster.local:8080"}
            - {name: USER_ENGINE_TENANT_MANAGEMENT_URL, value: "http://tenant-engine.tenant-engine.svc.cluster.local:8090"}
            - {name: USER_ENGINE_TENANT_MANAGEMENT_TOKEN, value: "internal-service-boundary"}
            - name: USER_ENGINE_PROVISIONING_TOKEN
              valueFrom:
                secretKeyRef: {name: identity-provisioner-client, key: token}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: {drop: ["ALL"]}
            readOnlyRootFilesystem: true
          resources:
            requests: {cpu: 50m, memory: 64Mi}
            limits: {cpu: 500m, memory: 256Mi}
          startupProbe:
            httpGet: {path: /readyz, port: http}
            failureThreshold: 30
            periodSeconds: 5
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 10
          livenessProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 20
---
apiVersion: v1
kind: Service
metadata: {name: user-engine, namespace: user-engine}
spec:
  selector: {app.kubernetes.io/name: user-engine}
  ports: [{name: http, port: 8080, targetPort: http}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: user-engine-default-deny, namespace: user-engine}
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: user-engine-runtime, namespace: user-engine}
spec:
  podSelector:
    matchLabels: {app.kubernetes.io/name: user-engine}
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports: [{protocol: TCP, port: 8080}]
  egress:
    - to:
        - podSelector:
            matchLabels: {cnpg.io/cluster: user-engine-pg}
      ports: [{protocol: TCP, port: 5432}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: sso}
          podSelector:
            matchLabels: {app.kubernetes.io/name: keycape}
      ports: [{protocol: TCP, port: 8080}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: sso}
          podSelector:
            matchLabels: {app.kubernetes.io/name: identity-provisioner}
      ports: [{protocol: TCP, port: 8080}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: tenant-engine}
          podSelector:
            matchLabels: {app.kubernetes.io/name: tenant-engine}
      ports: [{protocol: TCP, port: 8090}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: flex-auth}
          podSelector:
            matchLabels: {app.kubernetes.io/name: flex-auth-user-engine}
      ports: [{protocol: TCP, port: 8080}]
    # EMAIL-WP-0004 transactional invitation/verification send path.
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: email-connect}
          podSelector:
            matchLabels: {app.kubernetes.io/name: email-connect}
      ports: [{protocol: TCP, port: 8080}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: audit-core}
          podSelector:
            matchLabels: {app.kubernetes.io/name: audit-core}
      ports: [{protocol: TCP, port: 8080}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: user-engine-postgres, namespace: user-engine}
spec:
  podSelector:
    matchLabels: {cnpg.io/cluster: user-engine-pg}
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels: {app.kubernetes.io/name: user-engine}
      ports: [{protocol: TCP, port: 5432}]
    - from:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: cnpg-system}
      ports:
        - {protocol: TCP, port: 5432}
        - {protocol: TCP, port: 8000}
        - {protocol: TCP, port: 9187}
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: user-engine-backup
              app.kubernetes.io/part-of: user-engine
      ports: [{protocol: TCP, port: 5432}]
  egress:
    # CNPG instance manager must read its Cluster resource during bootstrap.
    # K3s network policy evaluates the API service after DNAT on port 6443.
    - ports: [{protocol: TCP, port: 6443}]
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]