# Static site fleet: one nginx Deployment + Service + Ingress + Certificate per site.
# Docroots come from hostPath /home/opc/zai-home-base/sites/<site> (built by deploy scripts).
# Edge routing/TLS: Traefik (80/443) + cert-manager Let's Encrypt secrets.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: static-nginx-conf
data:
  nginx.conf: |
    worker_processes 1;
    error_log /dev/stderr warn;
    pid /run/nginx.pid;
    events { worker_connections 1024; }
    http {
      include /etc/nginx/mime.types;
      default_type application/octet-stream;
      access_log /dev/stdout;
      sendfile on;
      gzip on;
      gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
      gzip_min_length 1024;
      server {
        listen 80;
        root /usr/share/nginx/html;
        index index.html;
        error_page 404 /404.html;
        add_header X-Content-Type-Options nosniff always;
        add_header Referrer-Policy strict-origin-when-cross-origin always;
        location ~* \.(css|js|svg|png|jpg|ico|woff2?)$ {
          expires 7d;
          add_header Cache-Control "public";
        }
        location / {
          try_files $uri $uri/ $uri/index.html =404;
        }
      }
    }
---
# ---------------- bestdadjokes.lol ----------------
apiVersion: apps/v1
kind: Deployment
metadata:
  name: static-bdj
  labels:
    site: bestdadjokes.lol
spec:
  replicas: 1
  selector:
    matchLabels:
      site: bestdadjokes.lol
  template:
    metadata:
      labels:
        site: bestdadjokes.lol
    spec:
      nodeSelector:
        kubernetes.io/hostname: djg-oracle-sl
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: nginx
          image: nginx:alpine
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: html
              mountPath: /usr/share/nginx/html
              readOnly: true
          resources:
            requests:
              cpu: 20m
              memory: 32Mi
            limits:
              memory: 128Mi
          readinessProbe:
            httpGet: {path: /, port: 80}
            initialDelaySeconds: 2
            periodSeconds: 20
      volumes:
        - name: conf
          configMap:
            name: static-nginx-conf
        - name: html
          hostPath:
            path: /home/opc/zai-home-base/sites/bestdadjokes
            type: Directory
---
apiVersion: v1
kind: Service
metadata:
  name: static-bdj
spec:
  selector:
    site: bestdadjokes.lol
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bestdadjokes
spec:
  rules:
    - host: bestdadjokes.lol
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: static-bdj
                port:
                  number: 80
    - host: www.bestdadjokes.lol
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: static-bdj
                port:
                  number: 80
  tls:
    - hosts:
        - bestdadjokes.lol
        - www.bestdadjokes.lol
      secretName: bestdadjokes-tls
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: bestdadjokes-lol
spec:
  secretName: bestdadjokes-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - bestdadjokes.lol
    - www.bestdadjokes.lol
---
# ---------------- myadhd.dev (placeholder) ----------------
apiVersion: apps/v1
kind: Deployment
metadata:
  name: static-adhd
  labels:
    site: myadhd.dev
spec:
  replicas: 1
  selector:
    matchLabels:
      site: myadhd.dev
  template:
    metadata:
      labels:
        site: myadhd.dev
    spec:
      nodeSelector:
        kubernetes.io/hostname: djg-oracle-sl
      tolerations:
        - key: node-role.kubernetes.io/master
          operator: Exists
          effect: NoSchedule
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: nginx
          image: nginx:alpine
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: html
              mountPath: /usr/share/nginx/html
              readOnly: true
          resources:
            requests:
              cpu: 20m
              memory: 32Mi
            limits:
              memory: 128Mi
          readinessProbe:
            httpGet: {path: /, port: 80}
            initialDelaySeconds: 2
            periodSeconds: 20
      volumes:
        - name: conf
          configMap:
            name: static-nginx-conf
        - name: html
          hostPath:
            path: /home/opc/zai-home-base/sites/myadhd.dev
            type: Directory
---
apiVersion: v1
kind: Service
metadata:
  name: static-adhd
spec:
  selector:
    site: myadhd.dev
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myadhd
spec:
  rules:
    - host: myadhd.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: static-adhd
                port:
                  number: 80
    - host: www.myadhd.dev
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: static-adhd
                port:
                  number: 80
  tls:
    - hosts:
        - myadhd.dev
        - www.myadhd.dev
      secretName: myadhd-tls
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: myadhd-dev
spec:
  secretName: myadhd-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - myadhd.dev
    - www.myadhd.dev