---
apiVersion: codemowers.cloud/v1beta1
kind: OIDCMiddlewareClient
metadata:
  name: etherpad
spec:
  displayName: Etherpad
  uri: 'https://pad.k-space.ee/'
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: etherpad
  namespace: etherpad
spec:
  # Etherpad does NOT support running multiple replicas due to
  # in-application caching https://github.com/ether/etherpad-lite/issues/3680
  revisionHistoryLimit: 0
  replicas: 1
  serviceName: etherpad
  selector:
    matchLabels:
      app: etherpad
  template:
    metadata:
      labels:
        app: etherpad
    spec:
      containers:
        - name: etherpad
          # Pinned exactly: the mutable :2 tag stopped booting offline. 2.x runs
          # `pnpm run prod`, and pnpm 11 re-checks deps before every run, so it
          # tried to fetch typescript at startup and died against the egress
          # NetworkPolicy. Fixed upstream in 3.0.0 (runtime pnpm bypass, #7718)
          # and 3.3.0 (air-gapped boot, #7911). 3.3.3 also closes a pre-auth
          # arbitrary file read in /static/* (GHSA-mc8w-wjhw-45x5).
          image: mirror.gcr.io/etherpad/etherpad:3.3.3
          securityContext:
            # Etherpad writes session key during start
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            runAsUser: 5001
          ports:
            - containerPort: 9001
          # SSO_ISSUER, ADMIN_SECRET, USER_SECRET, ADMIN_REDIRECT and
          # USER_REDIRECT live in application-secrets; without this they sit in
          # the Secret unused and Etherpad keeps logging that its embedded OIDC
          # clients use placeholder secrets.
          envFrom:
            - secretRef:
                name: application-secrets
          env:
            - name: MINIFY
              value: 'false'
            # No egress to the internet here, so switch off every outbound call
            # rather than letting them fail (knobs added upstream in 3.3.2).
            - name: UPDATES_TIER
              value: 'off'
            - name: PRIVACY_UPDATE_CHECK
              value: 'false'
            - name: PRIVACY_PLUGIN_CATALOG
              value: 'false'
            - name: DB_TYPE
              value: mysql
            # Without this ueberDB logs "not configured with charset undefined --
            # may lead to crashes when certain characters are pasted". Verified
            # against a restore of prod data that exports stay byte-identical.
            - name: DB_CHARSET
              value: utf8mb4
            - name: DB_HOST
              value: mariadb
            - name: DB_NAME
              value: etherpad
            - name: DB_USER
              value: etherpad
            - name: PAD_OPTIONS_NO_COLORS
              value: "true"
            - name: PAD_OPTIONS_USE_MONOSPACE_FONT
              value: "true"
            - name: PAD_OPTIONS_SHOW_CHAT
              value: "false"
            - name: TRUST_PROXY
              value: "true"
            - name: ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: application-secrets
                  key: ADMIN_PASSWORD
            - name: DB_PASS
              valueFrom:
                secretKeyRef:
                  name: mariadb-secrets
                  key: MYSQL_PASSWORD
---
apiVersion: v1
kind: Service
metadata:
  name: etherpad
  namespace: etherpad
spec:
  type: ClusterIP
  selector:
    app: etherpad
  ports:
    - protocol: TCP
      port: 9001
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: etherpad
  namespace: etherpad
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
spec:
  rules:
    - host: pad.k-space.ee
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: etherpad
                port:
                  number: 9001
  tls:
    - hosts:
        - "*.k-space.ee"
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: etherpad
  namespace: etherpad
spec:
  podSelector:
    matchLabels:
      app: etherpad
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: traefik
      ports:
        - port: 9001
          protocol: TCP
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: mariadb
      ports:
        - protocol: TCP
          port: 3306
    - to:
        - ipBlock:
            cidr: 10.96.0.10/32
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53          
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53