apiVersion: apps/v1
kind: Deployment
metadata:
  name: matrix-keycloak-bot
  namespace: default
  labels:
    app.kubernetes.io/name: matrix-keycloak-bot
    app.kubernetes.io/component: automation
spec:
  # Maintain exactly 1 replica to prevent duplicate event handling on Matrix syncs
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: matrix-keycloak-bot
  template:
    metadata:
      labels:
        app.kubernetes.io/name: matrix-keycloak-bot
    spec:
      imagePullSecrets:
        - name: forgejo-registry-secret
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
      containers:
        - name: bot
          image: weaver.mynest.love/nest/nest-matrix-bot:latest
          imagePullPolicy: Always
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          env:
            # --- Non-Sensitive Configuration ---
            - name: MATRIX_HOMESERVER
              value: "https://starling.mynest.love"
            - name: MATRIX_BOT_USER
              value: "@access-bot:starling.mynest.love"
            - name: ADMIN_ROOM_ID
              value: "!adminroomid:starling.mynest.love"
            - name: ADMIN_MATRIX_IDS
              value: "@nest:starling.mynest.love"
            - name: KEYCLOAK_URL
              value: "https://sso.mynest.love/"
            - name: KEYCLOAK_REALM
              value: "nest"
            - name: KEYCLOAK_CLIENT_ID
              value: "nest-matrix-bot"

            # --- Sensitive Credentials from Vault-managed Secret ---
            - name: MATRIX_BOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: matrix-bot-credentials
                  key: MATRIX_BOT_PASSWORD
            - name: KEYCLOAK_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: matrix-bot-credentials
                  key: KEYCLOAK_CLIENT_SECRET