# Guacamole complete deployment with OpenID/Authentik support
# This deployment includes:
# - Environment-based OpenID configuration
# - PostgreSQL backend for connections/users
# - Authentik uses Let's Encrypt (no custom cert import needed)
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: guacamole
  namespace: guacamole
  labels:
    app: guacamole
    component: client
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: guacamole
      component: client
  template:
    metadata:
      labels:
        app: guacamole
        component: client
    spec:
      automountServiceAccountToken: false
      containers:
        - name: guacamole
          image: guacamole/guacamole:1.6.0
          securityContext:
            runAsUser: 10000
            runAsGroup: 10000
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: tomcat-work
              mountPath: /usr/local/tomcat/work
            - name: tomcat-logs
              mountPath: /usr/local/tomcat/logs
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          env:
            - name: GUACD_HOSTNAME
              value: "guacd"
            - name: GUACD_PORT
              value: "4822"
            - name: POSTGRESQL_HOSTNAME
              value: "pg-guacamole-rw"
            - name: POSTGRESQL_PORT
              value: "5432"
            - name: POSTGRESQL_DATABASE
              value: "guacamole"
            - name: POSTGRESQL_ENABLED
              value: "true"
            - name: POSTGRESQL_USERNAME
              value: "guacamole"
            - name: POSTGRESQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: pg-guacamole-app
                  key: password
            - name: POSTGRESQL_AUTO_CREATE_ACCOUNTS
              value: "true"
            - name: ENABLE_ENVIRONMENT_PROPERTIES
              value: "true"
            - name: LOG_LEVEL
              value: "debug"
            - name: WEBAPP_CONTEXT
              value: "ROOT"
            # FIX: Enabled WebSockets to stop the 10-second tunnel timeout
            - name: ENABLE_WEBSOCKET
              value: "true"
            - name: EXTENSION_PRIORITY
              value: "openid,*"
            - name: OPENID_RESPONSE_TYPE
              value: "code"
            - name: OPENID_AUTHORIZATION_ENDPOINT
              value: "https://auth.kube.huskypup.net/application/o/authorize/"
            - name: OPENID_JWKS_ENDPOINT
              value: "https://auth.kube.huskypup.net/application/o/guacamole/jwks/"
            - name: OPENID_ISSUER
              value: "https://auth.kube.huskypup.net/application/o/guacamole/"
            - name: OPENID_TOKEN_ENDPOINT
              value: "https://auth.kube.huskypup.net/application/o/token/"
            - name: OPENID_REDIRECT_URI
              value: "https://guacamole.kube.huskypup.net/"
            - name: OPENID_USERNAME_CLAIM_TYPE
              value: "preferred_username"
            - name: OPENID_GROUPS_CLAIM_TYPE
              value: "groups"
            - name: OPENID_SCOPE
              value: "openid email profile groups"
            - name: OPENID_ALLOWED_CLOCK_SKEW
              value: "30"
            - name: OPENID_MAX_TOKEN_VALIDITY
              value: "300"
            - name: OPENID_MAX_NONCE_VALIDITY
              value: "60"
            - name: OPENID_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: guacamole-oauth-secret
                  key: client-id
            - name: OPENID_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: guacamole-oauth-secret
                  key: client-secret
          resources:
            requests:
              memory: "512Mi"
              cpu: "250m"
            limits:
              memory: "1Gi"
              cpu: "1000m"
          livenessProbe:
            httpGet:
              path: /api/languages
              port: http
            initialDelaySeconds: 60
            periodSeconds: 30
          # FIX: Relaxed readiness probe so minor DB lags don't kill the Endpoint
          readinessProbe:
            httpGet:
              path: /api/languages
              port: http
            initialDelaySeconds: 30
            periodSeconds: 15
            failureThreshold: 5
      volumes:
        - name: tmp
          emptyDir: {}
        - name: tomcat-work
          emptyDir: {}
        - name: tomcat-logs
          emptyDir: {}

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: guacd
  namespace: guacamole
  labels:
    app: guacamole
    component: guacd
spec:
  replicas: 1
  selector:
    matchLabels:
      app: guacamole
      component: guacd
  template:
    metadata:
      labels:
        app: guacamole
        component: guacd
    spec:
      automountServiceAccountToken: false
      containers:
        - name: guacd
          image: guacamole/guacd:1.6.0
          securityContext:
            runAsUser: 10000
            runAsGroup: 10000
            runAsNonRoot: true
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: home
              mountPath: /home
          ports:
            - name: guacd
              containerPort: 4822
              protocol: TCP
          env:
            - name: LOG_LEVEL
              value: "debug"
          resources:
            requests:
              memory: "256Mi"
              cpu: "10m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          readinessProbe:
            tcpSocket:
              port: 4822
            initialDelaySeconds: 2
            periodSeconds: 10
            timeoutSeconds: 1
            successThreshold: 1
            failureThreshold: 3
      volumes:
        - name: tmp
          emptyDir: {}
        - name: home
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: guacamole
  namespace: guacamole
  labels:
    app: guacamole
    component: client
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: http
      protocol: TCP
      name: http
  selector:
    app: guacamole
    component: client
---
apiVersion: v1
kind: Service
metadata:
  name: guacd
  namespace: guacamole
  labels:
    app: guacamole
    component: guacd
spec:
  type: ClusterIP
  ports:
    - port: 4822
      targetPort: guacd
      protocol: TCP
      name: guacd
  selector:
    app: guacamole
    component: guacd