apiVersion: apps/v1
kind: Deployment
metadata:
  name: stalwart-controller
  namespace: stalwart
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    spec:
      containers:
        - name: controller
          args:
            - --dsn-file
            - /run/database/dsn
            - --plan
            - /desired/plan.json
            - --secret-root
            - /run/control
            - --stalwart-url
            - http://stalwart-bootstrap.stalwart.svc.cluster.local:8080
            - --certificate-san
            - mail.quorate.dev
            - --bootstrap-user
            - recovery
            - --bootstrap-password-file
            - /run/bootstrap/password
            - --status-address
            - 0.0.0.0:9090
            - --interval
            - 5m
            - --initial-backoff
            - 5s
            - --max-backoff
            - 5m
            - --reconcile-timeout
            - 2m
            - --persistent-failure-after
            - "5"
          volumeMounts:
            - name: control
              mountPath: /run/control
              readOnly: true
            - name: bootstrap
              mountPath: /run/bootstrap
              readOnly: true
      volumes:
        - name: control
          projected:
            defaultMode: 0440
            sources:
              - secret:
                  name: stalwart-oidc
                  items:
                    - key: audience
                      path: oidc_audience
                    - key: controller_subject
                      path: oidc_controller_subject
                    - key: human_admin_subject
                      path: oidc_human_admin_subject
                    - key: issuer_url
                      path: oidc_issuer_url
                    - key: notifier_subject
                      path: oidc_notifier_subject
                    - key: sender_subject
                      path: oidc_sender_subject
                    - key: test_subject
                      path: oidc_test_subject
              - secret:
                  name: stalwart-runtime
                  items:
                    - key: dragonfly_url
                      path: dragonfly_url
              - secret:
                  name: stalwart-delivery
                  items:
                    - key: relay_endpoint
                      path: relay_endpoint
                    - key: relay_username
                      path: relay_username
        - name: bootstrap
          secret:
            secretName: stalwart-bootstrap
            defaultMode: 0440