apiVersion: apps/v1
kind: Deployment
metadata:
  name: git-server
  namespace: cicd
  labels:
    app: git-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: git-server
  template:
    metadata:
      labels:
        app: git-server
    spec:
      initContainers:
      - name: setup
        image: alpine:3.19
        command:
        - /bin/sh
        - -c
        - |
          # Setup SSH host keys directory
          mkdir -p /ssh-init
          chown -R 0:0 /ssh-init
          # Setup authorized_keys with correct ownership
          # The /ssh-git mount point IS the .ssh directory
          cp /ssh-keys-secret/authorized_keys /ssh-git/authorized_keys
          chown -R 1000:1000 /ssh-git
          chmod 755 /ssh-git
          chmod 644 /ssh-git/authorized_keys
        volumeMounts:
        - name: ssh-host-keys
          mountPath: /ssh-init
        - name: git-ssh-keys
          mountPath: /ssh-keys-secret
          readOnly: true
        - name: git-ssh-writable
          mountPath: /ssh-git

      containers:
      # Container 1: SSH Git Server
      - name: git-server
        image: registry.lan.buetow.org:30001/git-server:1.0
        imagePullPolicy: Always
        ports:
        - containerPort: 22
          name: ssh
          protocol: TCP
        volumeMounts:
        - name: repos
          mountPath: /repos
        - name: git-ssh-writable
          mountPath: /home/git/.ssh
        - name: ssh-host-keys
          mountPath: /etc/ssh
        securityContext:
          runAsUser: 0
          runAsGroup: 0
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
            add: ["SYS_CHROOT", "SETGID", "SETUID"]
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi

      # Container 2: CGit Web UI
      - name: cgit
        image: joseluisq/alpine-cgit:latest
        command: ["/bin/sh", "-c"]
        args:
        - |
          # Remove 'user nginx;' directive to avoid setgid errors when running as root
          sed -i 's/^user nginx;//' /etc/nginx/nginx.conf
          # Start fcgiwrap and set socket permissions for nginx user
          spawn-fcgi -s /var/run/fcgiwrap.sock -n -- /usr/bin/fcgiwrap &
          sleep 1
          chmod 666 /var/run/fcgiwrap.sock
          exec nginx -g 'daemon off;'
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        env:
        - name: CGIT_TITLE
          value: "f3s Git Repository Browser"
        - name: CGIT_DESC
          value: "Browse git repositories"
        - name: USE_CUSTOM_CONFIG
          value: "true"
        volumeMounts:
        - name: repos
          mountPath: /repos
          readOnly: true
        - name: cgit-config
          mountPath: /etc/cgitrc
          subPath: cgitrc
          readOnly: true
        securityContext:
          runAsUser: 0
          runAsGroup: 0
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
            add: ["SETGID", "SETUID"]
        resources:
          requests:
            cpu: 50m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi

      volumes:
      - name: repos
        persistentVolumeClaim:
          claimName: git-server-pvc
      - name: git-ssh-keys
        secret:
          secretName: git-server-authorized-keys
          defaultMode: 0400
      - name: git-ssh-writable
        emptyDir: {}
      - name: cgit-config
        configMap:
          name: cgit-config
      - name: ssh-host-keys
        emptyDir: {}