apiVersion: apps/v1
kind: Deployment
metadata:
  name: gibbz
  namespace: home
  labels:
    app: gibbz
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gibbz
  template:
    metadata:
      labels:
        app: gibbz
    spec:
      containers:
      - name: gibbz
        image: matst80/gibbz:latest
        imagePullPolicy: Always
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        env:
        - name: PORT
          value: "8080"
        - name: HOST
          value: "0.0.0.0"
        - name: OTEL_SERVICE_NAME
          value: "gibbz"
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: "http://otel-debug-service.monitoring.svc.cluster.local:4318"
        - name: STUN_URLS
          value: "stun:turn.k6n.net:3478,stun:stun.l.google.com:19302"
        - name: TURN_URLS
          value: "turn:turn.k6n.net:3478?transport=udp,turn:turn.k6n.net:3478?transport=tcp,turns:turn.k6n.net:5349?transport=tcp"
        # Route media through the public coturn service. This avoids selecting
        # direct/private candidates that fail across NATs or LAN hairpinning.
        - name: ICE_TRANSPORT_POLICY
          value: "relay"
        - name: TURN_SECRET
          valueFrom:
            secretKeyRef:
              name: coturn-secret
              key: static-auth-secret
              optional: true
        - name: TURN_USERNAME
          valueFrom:
            secretKeyRef:
              name: coturn-auth
              key: username
              optional: true
        - name: TURN_CREDENTIAL
          valueFrom:
            secretKeyRef:
              name: coturn-auth
              key: password
              optional: true
        - name: OTEL_INGEST_KEY
          valueFrom:
            secretKeyRef:
              name: otel-ingest-auth
              key: key
              optional: true
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 5
          periodSeconds: 10
          timeoutSeconds: 2
        readinessProbe:
          httpGet:
            path: /readyz
            port: http
          initialDelaySeconds: 3
          periodSeconds: 5
          timeoutSeconds: 2
---
apiVersion: v1
kind: Service
metadata:
  name: gibbz
  namespace: home
  labels:
    app: gibbz
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: http
    protocol: TCP
    name: http
  selector:
    app: gibbz
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gibbz-ingress
  namespace: home
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/websocket-services: "gibbz"
spec:
  ingressClassName: nginx
  rules:
  - host: gibbz.k6n.net
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: gibbz
            port:
              number: 80
  tls:
  - hosts:
    - gibbz.k6n.net
    secretName: gibbz-k6n-net-tls