# RPF-WP-0047: static "not publicly available" notice for bao.coulomb.social.
# OpenBao stays non-public (RMASTER-WP-0020-T09). This namespace has no route
# to OpenBao: ingress only from Traefik, no egress at all.
apiVersion: v1
kind: Namespace
metadata:
  name: bao-notice
  labels:
    app.kubernetes.io/part-of: railiance-platform
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bao-notice-isolation
  namespace: bao-notice
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          app.kubernetes.io/name: traefik
    ports:
    - {protocol: TCP, port: 8080}
  egress: []
---
# cert-manager HTTP-01 solver pods run in this namespace on 8089 during
# issuance and renewal; Traefik must reach them or the challenge gets 502.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bao-notice-acme-solver
  namespace: bao-notice
spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          app.kubernetes.io/name: traefik
    ports:
    - {protocol: TCP, port: 8089}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bao-notice
  namespace: bao-notice
  labels:
    app.kubernetes.io/name: bao-notice
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: bao-notice
  template:
    metadata:
      labels:
        app.kubernetes.io/name: bao-notice
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nginx
        image: nginxinc/nginx-unprivileged@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0
        ports:
        - {name: http, containerPort: 8080}
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: [ALL]
        resources:
          requests: {cpu: 5m, memory: 16Mi}
          limits: {cpu: 100m, memory: 64Mi}
        readinessProbe:
          httpGet: {path: /healthz, port: http}
          periodSeconds: 20
        livenessProbe:
          httpGet: {path: /healthz, port: http}
          periodSeconds: 60
        volumeMounts:
        - {name: conf, mountPath: /etc/nginx/conf.d, readOnly: true}
        - {name: html, mountPath: /usr/share/nginx/html, readOnly: true}
        - {name: tmp, mountPath: /tmp}
      volumes:
      - name: conf
        configMap:
          name: bao-notice-conf
          items: [{key: default.conf, path: default.conf}]
      - name: html
        configMap:
          name: bao-notice-html
          items: [{key: index.html, path: index.html}]
      - name: tmp
        emptyDir: {sizeLimit: 16Mi}
---
apiVersion: v1
kind: Service
metadata:
  name: bao-notice
  namespace: bao-notice
spec:
  selector:
    app.kubernetes.io/name: bao-notice
  ports:
  - {name: http, port: 80, targetPort: http}
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: redirect-https
  namespace: bao-notice
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bao-notice
  namespace: bao-notice
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
spec:
  ingressClassName: traefik
  tls:
  - hosts: [bao.coulomb.social]
    secretName: bao-notice-tls
  rules:
  - host: bao.coulomb.social
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: {name: bao-notice, port: {number: 80}}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bao-notice-http-redirect
  namespace: bao-notice
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: bao-notice-redirect-https@kubernetescrd
    traefik.ingress.kubernetes.io/router.priority: "1"
spec:
  ingressClassName: traefik
  rules:
  - host: bao.coulomb.social
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service: {name: bao-notice, port: {number: 80}}