apiVersion: apps/v1
kind: Deployment
metadata:
  name: vaultwarden
  labels:
    app: vaultwarden
spec:
  replicas: 1
  strategy:
    type: Recreate # the RWO local volume cannot be mounted by two pods
  selector:
    matchLabels:
      app: vaultwarden
  template:
    metadata:
      labels:
        app: vaultwarden
    spec:
      nodeSelector:
        kubernetes.io/hostname: music
      containers:
        - name: vaultwarden
          image: vaultwarden/server:1.37.3
          resources:
            requests:
              memory: 128Mi
              cpu: 100m
            limits:
              memory: 512Mi
          # SSO is switched on by the optional Secret vaultwarden-sso, which holds
          # SSO_ENABLED=true and SSO_CLIENT_SECRET (the secret of the Keycloak client
          # "Vaultwarden"). Without it Vaultwarden starts with SSO off.
          envFrom:
            - secretRef:
                name: vaultwarden-sso
                optional: true
          env:
            - name: DOMAIN
              value: https://vw.hexor.cy
            - name: ORG_GROUPS_ENABLED
              value: "true"
            - name: SSO_AUTHORITY
              value: https://auth.hexor.cy/auth/realms/hexor
            - name: SSO_CLIENT_ID
              value: Vaultwarden
            - name: SSO_SCOPES
              value: openid profile email offline_access
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: vaultwarden-db-url
                  key: DATABASE_URL
            - name: ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: admin-token
                  key: ADMIN_TOKEN
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /alive
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /alive
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: vaultwarden-data-music