apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ name }}
  namespace: {{ namespace }}
  labels:
    app: {{ name }}
    service.identity: {{ name }}.{{ namespace }}
spec:
  replicas: {{ replicas }}
  selector:
    matchLabels:
      app: {{ name }}
  template:
    metadata:
      labels:
        app: {{ name }}
        service.identity: {{ name }}.{{ namespace }}
      annotations:
{{ mesh_pod_annotations }}
    spec:
{%- if has_pod_security %}
      securityContext:
{{ pod_security_yaml }}
{%- endif %}
{%- if has_migrations_init %}
      initContainers:
        - name: migrate
          image: {{ image }}
          command: {{ migrations_command | json_encode | safe }}
          workingDir: /app
          env:
{%- for kv in stateful_env_literals %}
            - name: {{ kv.0 }}
              value: "{{ kv.1 }}"
{%- endfor %}
{%- if has_db_secret %}
          envFrom:
            - secretRef:
                name: {{ name }}-db-credentials
{%- endif %}
{%- endif %}
      containers:
        - name: {% if is_web %}web{% else %}server{% endif %}
          image: {{ image }}
{%- if has_container_security %}
          securityContext:
{{ container_security_yaml }}
{%- endif %}
{%- if is_web %}
          # Web (Next.js standalone). Listens on :3000.
          env:
            - name: NODE_ENV
              value: "production"
            - name: BACKEND_URL
              value: "http://backend.{{ namespace }}.svc.cluster.local:50051"
            - name: OTEL_SERVICE_NAME
              value: "{{ name }}"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://otel-collector.observability.svc.cluster.local:4317"
{%- for kv in stateful_env_literals %}
            - name: {{ kv.0 }}
              value: "{{ kv.1 }}"
{%- endfor %}
          ports:
            - containerPort: {{ port }}
              name: http
{%- else %}
          command: ["/usr/local/bin/{{ name }}"]
          env:
            - name: OTEL_SERVICE_NAME
              value: "{{ name }}"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://otel-collector.observability.svc.cluster.local:4317"
            - name: OTEL_RESOURCE_ATTRIBUTES
              value: "service.namespace={{ namespace }},service.version={{ version }}"
            - name: RUST_LOG
              value: "info"
{#- Secret-sourced vars first so k8s can expand $(DATABASE_PASSWORD) inside the
    DATABASE_URL literal that follows. #}
{%- for key in stateful_env_from_secret %}
            - name: {{ key }}
              valueFrom:
                secretKeyRef:
                  name: {{ name }}-secrets
                  key: {{ key }}
{%- endfor %}
{%- for kv in stateful_env_literals %}
            - name: {{ kv.0 }}
              value: "{{ kv.1 }}"
{%- endfor %}
          ports:
            - containerPort: {{ port }}
              name: {% if is_http %}http{% else %}grpc{% endif %}
{%- if has_http_port %}
            - containerPort: {{ http_port }}
              name: http
{%- endif %}
{%- if has_health %}
          livenessProbe:
{%- if health_grpc %}
            grpc:
              port: {{ health_port }}
{%- else %}
            httpGet:
              path: {{ health_path }}
              port: {{ health_port }}
{%- endif %}
            periodSeconds: 10
            failureThreshold: 3
          readinessProbe:
{%- if health_grpc %}
            grpc:
              port: {{ health_port }}
{%- else %}
            httpGet:
              path: {{ health_path }}
              port: {{ health_port }}
{%- endif %}
            periodSeconds: 5
            failureThreshold: 3
{%- endif %}
{%- endif %}
{%- if has_db_secret %}
          envFrom:
            - secretRef:
                name: {{ name }}-db-credentials
{%- endif %}
          resources:
            requests: { cpu: {{ cpu }}, memory: {{ memory }} }
            limits:   { cpu: {{ cpu }}, memory: {{ memory }} }
{%- if mcp_sidecar %}
        - name: mcp
          image: {{ image }}
          command: ["/usr/local/bin/{{ name }}-mcp"]
          env:
            - name: GRPC_ENDPOINT
              value: "http://localhost:50051"
            - name: OTEL_SERVICE_NAME
              value: "{{ name }}-mcp"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "http://otel-collector.observability.svc.cluster.local:4317"
          ports:
            - containerPort: 50052
              name: mcp
{%- endif %}
