apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-mcp-auth-proxy
  labels:
    app: gitea-mcp-auth-proxy
  annotations:
    security.note/healthz: "Do not expose /healthz publicly; keep service internal and restrict ingress at network/ingress layer."
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitea-mcp-auth-proxy
  template:
    metadata:
      labels:
        app: gitea-mcp-auth-proxy
    spec:
      containers:
        - name: auth-proxy
          image: gitea.nehmer.net/torben/gitea-mcp-auth-proxy:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: AUTH_PROXY_LISTEN_ADDR
              value: ":8080"
            - name: AUTH_PROXY_TOKEN_HASHES_DIR
              value: /var/run/secrets/auth-proxy
            - name: AUTH_PROXY_LOG_LEVEL
              value: info
          volumeMounts:
            - name: auth-tokens
              mountPath: /var/run/secrets/auth-proxy
              readOnly: true
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 2
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 15
      volumes:
        - name: auth-tokens
          secret:
            secretName: gitea-mcp-auth-proxy-tokens