apiVersion: v1
kind: Namespace
metadata:
  name: reverse-proxy
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reverse-proxy
  namespace: reverse-proxy
  annotations:
    reloader.stakater.com/search: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: reverse-proxy
  template:
    metadata:
      labels:
        app: reverse-proxy
    spec:
      nodeName: kube-master
      # Allows the sidecar to see and signal the Nginx process
      shareProcessNamespace: true
      containers:
      #- image: nginx:alpine
      - image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
        imagePullPolicy: IfNotPresent
        name: reverse-proxy
        ports:
        - containerPort: 80
          name: rp-port-http
        - containerPort: 443
          name: rp-port-https
        volumeMounts:
        - name: nginx-sites-terraform
          mountPath: /etc/nginx/conf.d/
        - mountPath: /var/log/nginx/
          name: reverse-proxy-log
        - name: extra-sites-terraform
          mountPath: /etc/nginx/extra.conf.d/
        - name: deny-ip-terraform
          mountPath: /etc/nginx/deny.d/
        - name: blacklisted-sessions-map
          mountPath: /etc/nginx/blacklisted.d/
        - name: reverse-proxy-ssl
          mountPath: /etc/nginx/ssl/
        - mountPath: /etc/nginx/
          name: nginx-configfile
        - name: proxy-cache-path-volume
          mountPath: /tmp/cache/
        - name: secret-htpasswd
          mountPath: /authentication-htpasswd/
        resources:
            limits:
              cpu: 250m
              memory: 250Mi
      - name: watcher
        image: alpine:latest
        command: ["/bin/sh", "-c"]
        args:
          - |
            apk add --no-cache inotify-tools;
            echo "Watcher started..."
            while inotifywait -e close_write /etc/nginx/blacklisted.d/blacklisted-sessions.conf; do
              echo "Change detected in deny.conf, reloading Nginx..."
              # Find the Nginx master process and send SIGHUP (reload)
              pkill -HUP nginx
            done
        volumeMounts:
        - name: blacklisted-sessions-map
          mountPath: /etc/nginx/blacklisted.d/


      volumes:
      - name: reverse-proxy-log
        persistentVolumeClaim:
          claimName: reverse-proxy-log
      - name: reverse-proxy-ssl
        hostPath:
           path: /opt/kubernetes/Reverse_proxy_Nginx/certbot/conf/
      - name: nginx-configfile
        configMap:
          name: nginx-config
          defaultMode: 0555
      - name: nginx-sites-terraform
        configMap:
          name: sites-terraform
          defaultMode: 0555
      - name: extra-sites-terraform
        configMap:
          name: extra-sites-terraform
          defaultMode: 0555
      - name: deny-ip-terraform
        configMap:
          name: deny-ip-terraform
          defaultMode: 0555
      - name: proxy-cache-path-volume
        emptyDir:
          medium: Memory
      - name: secret-htpasswd
        secret:
          secretName: htpasswd
      - name: blacklisted-sessions-map
        persistentVolumeClaim:
          claimName: blacklisted-sessions-map
---
apiVersion: v1
kind: Service
metadata:
  name: reverse-proxy
  namespace: reverse-proxy
spec:
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      targetPort: rp-port-http
      protocol: TCP
      nodePort: 30080
    - name: https
      port: 443
      targetPort: rp-port-https
      protocol: TCP
      nodePort: 30443

  type: NodePort
  selector:
    app: reverse-proxy