apiVersion: v1
kind: Namespace
metadata:
  name: reverse-proxy
---
apiVersion: apps/v1
#kind: Deployment
kind: DaemonSet
metadata:
  name: reverse-proxy
  namespace: reverse-proxy
  annotations:
    reloader.stakater.com/search: "true"
spec:
  #replicas: 1
  selector:
    matchLabels:
      app: reverse-proxy
  template:
    metadata:
      labels:
        app: reverse-proxy
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet   # required when hostNetwork: true
      #nodeName: kube-master
      # Allows the sidecar to see and signal the Nginx process
      shareProcessNamespace: true
      containers:
      #- image: nginx:alpine
      - image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
        imagePullPolicy: IfNotPresent
        name: reverse-proxy
        ports:
        - containerPort: 80
          name: rp-port-http
        - containerPort: 443
          name: rp-port-https
        volumeMounts:
        - name: nginx-sites-terraform
          mountPath: /etc/nginx/conf.d/
        - mountPath: /var/log/nginx/
          name: reverse-proxy-log
        - name: extra-sites-terraform
          mountPath: /etc/nginx/extra.conf.d/
        - name: deny-ip-terraform
          mountPath: /etc/nginx/deny.d/
        - name: blacklisted-sessions-map
          mountPath: /etc/nginx/blacklisted.d/
        - name: geoip-allow-terraform
          mountPath: /etc/nginx/geoip.d/
        - name: blacklisted-memory-volume
          mountPath: /etc/nginx/blacklisted.memory.d/
        - name: reverse-proxy-ssl
          mountPath: /etc/nginx/ssl/
        - mountPath: /etc/nginx/
          name: nginx-configfile
        - name: proxy-cache-path-volume
          mountPath: /tmp/cache/
        - name: secret-htpasswd
          mountPath: /authentication-htpasswd/
        - name: myprivatecacrt
          mountPath: /etc/nginx/certs/

        resources:
            limits:
              cpu: 250m
              memory: 250Mi

      - name: watcher
        image: alpine:latest
        command: ["/bin/sh", "-c"]
        args:
          - |

             apk add --no-cache inotify-tools;
             # Ensure file exists so inotify doesn't fail
             touch /etc/nginx/blacklisted.d/blacklisted-sessions.conf;
             echo "Watcher started on /etc/nginx/blacklisted.d/blacklisted-sessions.conf"
        
             while inotifywait -e modify /etc/nginx/blacklisted.d/blacklisted-sessions.conf; do
               echo "Change detected, waiting 5 seconds to batch updates..."
               sleep 5;
          
               # Check if Nginx is actually running before signaling
               if pgrep nginx > /dev/null; then
                 echo "Reloading Nginx..."
                 pkill -HUP nginx
               fi
             done

        volumeMounts:
        - name: blacklisted-memory-volume
          mountPath: /etc/nginx/blacklisted.d/
      tolerations:
      # these tolerations are to have the daemonset runnable on control plane nodes
      # remove them if your control plane nodes should not run pods
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      - key: node-role.kubernetes.io/master
        operator: Exists
        effect: NoSchedule

      volumes:
      - name: reverse-proxy-log
        persistentVolumeClaim:
          claimName: reverse-proxy-log
      - name: reverse-proxy-ssl
        hostPath:
           path: /opt/kubernetes/Reverse_proxy_Nginx/certbot/conf/
      - name: nginx-configfile
        configMap:
          name: nginx-config
          defaultMode: 0555
      - name: nginx-sites-terraform
        configMap:
          name: sites-terraform
          defaultMode: 0555
      - name: extra-sites-terraform
        configMap:
          name: extra-sites-terraform
          defaultMode: 0555
      - name: deny-ip-terraform
        configMap:
          name: deny-ip-terraform
          defaultMode: 0555
      - name: geoip-allow-terraform
        configMap:
          name: geoip-allow
          defaultMode: 0555
      - name: proxy-cache-path-volume
        emptyDir:
          medium: Memory
      - name: secret-htpasswd
        secret:
          secretName: htpasswd
      - name: blacklisted-sessions-map
        persistentVolumeClaim:
          claimName: blacklisted-sessions-map
      - name: blacklisted-memory-volume
        emptyDir:
          medium: Memory
      - name: myprivatecacrt
        configMap:
          name: myprivatecacrt
          defaultMode: 0555


---
apiVersion: v1
kind: Service
metadata:
  name: reverse-proxy
  namespace: reverse-proxy
spec:
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      targetPort: rp-port-http
      protocol: TCP
      nodePort: 30080
    - name: https
      port: 443
      targetPort: rp-port-https
      protocol: TCP
      nodePort: 30443

  type: NodePort
  selector:
    app: reverse-proxy

---
apiVersion: v1
kind: Service
metadata:
  name: reverse-proxy-load
  namespace: reverse-proxy
  annotations:
spec:
  ipFamilyPolicy: PreferDualStack
  ports:
    - name: http
      port: 80
      targetPort: rp-port-http
      protocol: TCP

    - name: https
      port: 443
      targetPort: rp-port-https
      protocol: TCP


  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app: reverse-proxy