apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  labels:
    app: backend
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
    spec:
      serviceAccountName: investibook-backend
      containers:
        - name: backend
          image: investibook/backend:latest
          ports:
            - containerPort: 8000
          envFrom:
            - configMapRef:
                name: investibook-backend-config
                optional: true
          env:
            # Application settings
            - name: PORT
              value: "8000"
            - name: HOST
              value: "0.0.0.0"
            - name: ACP_AGENT_TYPE
              value: "opencode"
            - name: ACP_AGENT_BIN
              value: ""
            - name: ACP_MODEL
              value: ""
            - name: AGENT_PROVIDER_CONFIG
              value: "/data/opencode-config/opencode/opencode.jsonc"
            - name: AGENT_MODEL_STANDARD
              value: "chat/claude-standard/high"
            - name: AGENT_MODEL_PRO
              value: "chat/claude-pro/high"
            - name: DATA_DIR
              value: "/data"
            - name: TEMPLATES_DIR
              value: "/app/templates"
            - name: AGENTS_DIR
              value: "/opt/agentkit"
            - name: PANEL_DATA_DIR
              value: "/opt/agentkit/data"
            - name: XDG_DATA_HOME
              value: "/data/.opencode"
            # Pin opencode's global config dir onto the PVC so its
            # `node_modules` (auto-reified on first invocation by opencode
            # itself) survives pod restarts and serves as the shared source
            # workspaces symlink into. Resolved layout:
            # XDG_CONFIG_HOME/opencode -> /data/opencode-config/opencode
            - name: XDG_CONFIG_HOME
              value: "/data/opencode-config"
            - name: LARK_BASE_URL
              valueFrom:
                configMapKeyRef:
                  name: investibook-backend-config
                  key: LARK_BASE_URL
                  optional: true
            - name: LARK_BOT_NAME
              valueFrom:
                configMapKeyRef:
                  name: investibook-backend-config
                  key: LARK_BOT_NAME
                  optional: true
            - name: CHATBOT_SESSION_TIMEOUT_MINUTES
              valueFrom:
                configMapKeyRef:
                  name: investibook-backend-config
                  key: CHATBOT_SESSION_TIMEOUT_MINUTES
                  optional: true
            # DevOps skill credentials (secret)
            - name: DEVOPS_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: DEVOPS_API_KEY

            # Route-scoped identity used by Alertstore to create workspaces.
            - name: INVESTIBOOK_ALERT_INGEST_SERVICE_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: ALERT_INGEST_SERVICE_TOKEN
                  optional: true
            - name: INVESTIBOOK_ALERT_INGEST_SERVICE_EMAIL
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: ALERT_INGEST_SERVICE_EMAIL
                  optional: true

            # Agent provider credentials
            - name: AWS_BEARER_TOKEN_BEDROCK
              valueFrom:
                secretKeyRef:
                  name: agent-provider-secret
                  key: AWS_BEARER_TOKEN_BEDROCK

            # Admin email allowlist
            - name: ADMIN_EMAILS
              value: "chenyiwen@pingcap.com,lingtao.li@pingcap.com,chensiyu@pingcap.com,charles.m@pingcap.com,chenshuning@pingcap.com,xieyujie@pingcap.com,fuchao.lan@pingcap.com,nizheming@pingcap.com,huyibin@pingcap.com,dihong.wang@pingcap.com,xuhuaiyu@pingcap.com,huoyao@pingcap.com"

            # Auth0 SSO (optional — leave empty to use email-only login)
            - name: AUTH0_DOMAIN
              valueFrom:
                secretKeyRef:
                  name: auth0-secret
                  key: AUTH0_DOMAIN
            - name: AUTH0_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: auth0-secret
                  key: AUTH0_CLIENT_ID

            # Investibook configuration - Secret values
            - name: INVESTIBOOK_JIRA_USERNAME
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: JIRA_USERNAME
            - name: LARK_APP_ID
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: LARK_APP_ID
            - name: LARK_APP_SECRET
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: LARK_APP_SECRET
            - name: LARK_VERIFICATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: LARK_VERIFICATION_TOKEN
            - name: LARK_ENCRYPT_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: LARK_ENCRYPT_KEY
            - name: INVESTIBOOK_JIRA_API_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: JIRA_API_TOKEN
            - name: INVESTIBOOK_CLINIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: CLINIC_API_KEY
            - name: INVESTIBOOK_OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: OPENAI_API_KEY
            - name: INVESTIBOOK_CALLBACK_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: CALLBACK_API_KEY
            - name: LANGFUSE_PUBLIC_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-langfuse-secret
                  key: LANGFUSE_PUBLIC_KEY
                  optional: true
            - name: LANGFUSE_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-langfuse-secret
                  key: LANGFUSE_SECRET_KEY
                  optional: true
            - name: SKILL_CLINIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: SKILL_CLINIC_API_KEY
            - name: SKILL_GITHUB_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: SKILL_GITHUB_TOKEN
          startupProbe:
            httpGet:
              path: /health
              port: 8000
            periodSeconds: 2
            failureThreshold: 15
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          volumeMounts:
            - name: agent-config
              # Must match XDG_CONFIG_HOME/opencode/opencode.jsonc so opencode's
              # config discovery picks it up.
              mountPath: /data/opencode-config/opencode/opencode.jsonc
              subPath: opencode.jsonc
              readOnly: true
            - name: data
              mountPath: /data
          readinessProbe:
            httpGet:
              path: /health
              port: 8000
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: "500m"
              memory: "1Gi"
            limits:
              cpu: "4000m"
              memory: "16Gi"
      restartPolicy: Always
      volumes:
        - name: agent-config
          configMap:
            name: agent-config
        - name: data
          persistentVolumeClaim:
            claimName: investibook-data