apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${CI_PROJECT_PATH_SLUG}-app
  template:
    metadata:
      labels:
        app: ${CI_PROJECT_PATH_SLUG}-app
    spec:
      containers:
        - name: ${CI_PROJECT_PATH_SLUG}-container
          image: $IMAGE_TAG
      imagePullSecrets:
        - name: docker-registry-credentials
      securityContext:
        runAsUser: 33
        runAsGroup: 33
        fsGroup: 33
        fsGroupChangePolicy: "OnRootMismatch"
---
apiVersion: v1
kind: Service
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-service
spec:
  selector:
    app: ${CI_PROJECT_PATH_SLUG}-app
  ports:
    - port: 80
      targetPort: 443
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-ingress-route
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`${APP_DOMAIN}`)
      kind: Rule
      services:
        - name: ${CI_PROJECT_PATH_SLUG}-service
          port: 80
  tls:
    secretName: ${CRT_TLS_NAME}