neiam /oh-my-ex-oh-ircd

# IRC daemon Deployment. 3 replicas form a libcluster mesh via the
# headless Service; Horde keeps Channel/User singletons distributed
# across them.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ircd
  namespace: ircd
  labels: { app: ircd }
spec:
  replicas: 3
  selector:
    matchLabels: { app: ircd }
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels: { app: ircd }
    spec:
      serviceAccountName: ircd
      terminationGracePeriodSeconds: 30
      containers:
        - name: ircd
          # Use the :kubernetes-tagged image from CI — it's compiled
          # without site_encrypt; the cert below comes from cert-manager.
          image: registry.example.com/oh_my_ex_oh_ircd:kubernetes-master
          imagePullPolicy: Always
          ports:
            - { name: http, containerPort: 4000 }
            - { name: irc,  containerPort: 6667 }
            - { name: ircs, containerPort: 6697 }
            - { name: epmd, containerPort: 4369 }
            - { name: dist, containerPort: 9100 }
          env:
            # Phoenix bring-up
            - { name: PHX_SERVER, value: "true" }
            - { name: PHX_HOST,   value: "irc.example.com" }
            - { name: PORT,       value: "4000" }
            # IRC config
            - { name: IRC_PORT,         value: "6667" }
            - { name: IRC_SERVER_NAME,  value: "irc.example.com" }
            - { name: IRC_NETWORK_NAME, value: "ExampleNet" }
            - { name: IRC_ALLOW_ANONYMOUS, value: "false" }
            # Set to "true" to expose the in-browser /webirc client.
            - { name: WEBIRC_ENABLED,      value: "false" }
            # IRC TLS — paths point at the cert-manager Secret mounted below.
            - { name: IRC_TLS_ENABLED,    value: "true" }
            - { name: IRC_TLS_PORT,       value: "6697" }
            - { name: IRC_TLS_CERT_PATH,  value: "/etc/tls/tls.crt" }
            - { name: IRC_TLS_KEY_PATH,   value: "/etc/tls/tls.key" }
            # BEAM cluster
            - { name: CLUSTER_STRATEGY,     value: "kubernetes" }
            - { name: CLUSTER_K8S_NAMESPACE, value: "ircd" }
            - { name: CLUSTER_K8S_SERVICE,   value: "ircd-headless" }
            - { name: CLUSTER_K8S_APP_NAME,  value: "ircd" }
            - { name: CLUSTER_K8S_SELECTOR,  value: "app=ircd" }
            - name: POD_IP
              valueFrom: { fieldRef: { fieldPath: status.podIP } }
            # Secrets
            - name: DATABASE_URL
              valueFrom: { secretKeyRef: { name: ircd-secrets, key: DATABASE_URL } }
            - name: SECRET_KEY_BASE
              valueFrom: { secretKeyRef: { name: ircd-secrets, key: SECRET_KEY_BASE } }
            - name: RELEASE_COOKIE
              valueFrom: { secretKeyRef: { name: ircd-secrets, key: RELEASE_COOKIE } }
          volumeMounts:
            - name: tls
              mountPath: /etc/tls
              readOnly: true
          readinessProbe:
            httpGet: { path: /, port: http }
            initialDelaySeconds: 10
            periodSeconds: 5
          livenessProbe:
            tcpSocket: { port: irc }
            initialDelaySeconds: 30
            periodSeconds: 15
          resources:
            requests: { cpu: 100m, memory: 256Mi }
            limits:   { cpu: 1,    memory: 1Gi }
      volumes:
        - name: tls
          secret:
            secretName: irc-tls