# Plattformstjänsten: självhostad auth, händelse-API och Live Share-delning.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: plattform
  namespace: guidad-felsokning
  labels: { app: plattform }
spec:
  replicas: 2
  selector:
    matchLabels: { app: plattform }
  template:
    metadata:
      labels: { app: plattform }
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
        - name: plattform
          image: ghcr.io/ORGANISATION/guidad-felsokning-plattform:latest # ersätt med ert registry
          ports:
            - containerPort: 8080
          env:
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef: { name: felsokning-hemligheter, key: jwt-secret }
            # Krypteringsnyckel för kundernas märkesspecifika credentials
            # (32 byte hex eller base64). Saknas den sparas inga uppgifter
            # alls — tjänsten failar closed i stället för att lagra i klartext.
            - name: INTEGRATION_NYCKEL
              valueFrom:
                secretKeyRef: { name: felsokning-hemligheter, key: integration-nyckel }
            - name: POSTGRES_LOSENORD
              valueFrom:
                secretKeyRef: { name: felsokning-hemligheter, key: postgres-losenord }
            - name: DATABASE_URL
              value: postgresql://plattform:$(POSTGRES_LOSENORD)@postgres:5432/felsokning
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits: { cpu: "1", memory: 256Mi }
          readinessProbe:
            httpGet: { path: /halsa, port: 8080 }
            initialDelaySeconds: 3
          livenessProbe:
            httpGet: { path: /halsa, port: 8080 }
            periodSeconds: 15
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: [ALL] }
---
apiVersion: v1
kind: Service
metadata:
  name: plattform
  namespace: guidad-felsokning
spec:
  selector: { app: plattform }
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: plattform
  namespace: guidad-felsokning
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: plattform }
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: plattform
  namespace: guidad-felsokning
spec:
  minAvailable: 1
  selector:
    matchLabels: { app: plattform }