apiVersion: v1
kind: Secret
metadata:
  name: nebula-sync-secret
  labels:
    project: pihole
    project: nebula-sync

data:
  # https
  # echo -n "something" | base64
  PRIMARY: 
  REPLICAS: 


---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nebula-sync-configmap
  
  labels:
    project: pihole
    project: nebula-sync

data:
  FULL_SYNC: "true"
  CRON: "25 */3 * * *"
  RUN_GRAVITY: "true"
  TZ: Europe/Stockholm
  CLIENT_SKIP_TLS_VERIFICATION: "true"
  SYNC_GRAVITY_CLIENT: "true"
  SYNC_CONFIG_DNS: "true"  
  SYNC_CONFIG_RESOLVER: "true"
  SYNC_CONFIG_DATABASE: "true"
  SYNC_CONFIG_MISC: "true"
  SYNC_GRAVITY_GROUP: "true"
  SYNC_GRAVITY_AD_LIST: "true"
  SYNC_GRAVITY_DOMAIN_LIST: "true"
  SYNC_GRAVITY_CLIENT: "true"



---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nebula-sync-deployment
  
  labels:
    project: pihole
    project: nebula-sync


spec:
  replicas: 1
  selector:
    matchLabels:
      pod-project: nebula-sync
  template:
    metadata:
      labels:
        pod-project: nebula-sync
        # pod-project: doh
    spec:
      automountServiceAccountToken: false   # Container doesn't need service account token
      securityContext:
        appArmorProfile:
          type: RuntimeDefault
        runAsNonRoot: true
        # fsGroup: 1500
        runAsGroup: 1500
        runAsUser: 1500       
      containers:
        - name: nebula-sync
          image: ghcr.io/lovelaze/nebula-sync
          imagePullPolicy: IfNotPresent
          envFrom:
            - configMapRef:
                name: nebula-sync-configmap
            - secretRef:
                name: nebula-sync-secret
          resources:
            requests:
              memory: "152Mi"
              cpu: "100m"
            limits:
              memory: "384Mi"
              # cpu: "550m"


---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nebula-sync-netwrokpolicy
  
  labels:
    project: pihole
    project: nebula-sync

spec:
  podSelector:
    matchLabels:
      pod-project: nebula-sync
  egress:
    # Allow connecting to CoreDNS
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53  

    # - to:
    #     - namespaceSelector:
    #         matchLabels:
    #           kubernetes.io/metadata.name: <YourNameSpace>
    #       podSelector:
    #         matchLabels:
    #           pod-project: pihole
      ports:
        - protocol: TCP
          port: 443   

  ingress:
    # - from:
    #     - namespaceSelector:
    #         matchLabels:
    #           kubernetes.io/metadata.name: private-srvc
    #       podSelector:
    #         matchLabels:
    #           pod-project: pihole
    #           project-ns-name: private-srvc
              

  policyTypes:
    - Ingress
    - Egress