apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "waf-cluster.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "waf-cluster.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "waf-cluster.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "waf-cluster.selectorLabels" . | nindent 8 }}
      annotations:
        # Force un rollout des pods quand la ConfigMap (nginx.conf,
        # custom-rules.conf) change — sinon nginx garde l'ancienne config en
        # mémoire jusqu'au prochain redémarrage manuel (les changements de
        # ConfigMap seule ne déclenchent pas de rollout par défaut).
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      # Pas de readOnlyRootFilesystem ici : l'image owasp/modsecurity-crs
      # écrit à plusieurs endroits internes à /etc/nginx/modsec (activation
      # des plugins CRS, génération de la config paranoia/anomaly) au
      # démarrage — voir les logs "Running CRS plugin activation" /
      # "Running CRS rule configuration". Même posture que docker/waf
      # (omnex-prod), qui tourne avec cette même image sans souci. À
      # durcir plus tard une fois le mapping exact des chemins écrits
      # identifié (cf. la mésaventure readOnlyRootFilesystem sur le
      # frontend, deploy/chart-gestion/frontend).
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: waf
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          env:
            - name: DISABLE_MODSEC_ENV_SUBST
              value: "true"
            - name: PARANOIA
              value: "{{ .Values.waf.paranoia }}"
            - name: ANOMALY_INBOUND
              value: "{{ .Values.waf.anomalyInbound }}"
            - name: ANOMALY_OUTBOUND
              value: "{{ .Values.waf.anomalyOutbound }}"
            - name: MODSEC_AUDIT_LOG
              value: "/var/log/modsec/modsec_audit.log"
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/conf.d/app.conf
              subPath: app.conf
            - name: conf
              mountPath: /etc/nginx/modsec/custom-rules.conf
              subPath: custom-rules.conf
            - name: certs
              mountPath: /etc/nginx/certs
              readOnly: true
            {{- range $i, $e := .Values.tls.extra }}
            - name: certs-extra-{{ $i }}
              mountPath: /etc/nginx/certs-extra-{{ $i }}
              readOnly: true
            {{- end }}
            - name: modsec-log
              mountPath: /var/log/modsec
          livenessProbe:
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /healthz
              port: https
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
        - name: conf
          configMap:
            name: {{ include "waf-cluster.fullname" . }}-conf
        - name: certs
          secret:
            secretName: {{ .Values.tls.secretName }}
        {{- range $i, $e := .Values.tls.extra }}
        - name: certs-extra-{{ $i }}
          secret:
            secretName: {{ $e.secretName }}
        {{- end }}
        - name: modsec-log
          emptyDir: {}