# StatefulSet: OpenSSH workspace + DinD sidecar.
# Image tag is updated by Flux ImageUpdateAutomation (SHA-bearing run_number-sha tags).

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cursor-devbox
  namespace: cursor-devbox
spec:
  serviceName: cursor-devbox
  replicas: 1
  selector:
    matchLabels:
      app: cursor-devbox
  template:
    metadata:
      labels:
        app: cursor-devbox
      annotations:
        linkerd.io/inject: disabled
    spec:
      terminationGracePeriodSeconds: 30
      imagePullSecrets:
        - name: dcr-registry-auth-ro
      containers:
        - name: ssh
          image: dcr.trinitysan.by/infra/cursor-devbox:latest # {"$imagepolicy": "flux-system:cursor-devbox"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: ssh
              containerPort: 22
            - name: http
              containerPort: 8080
          env:
            - name: DOCKER_HOST
              value: tcp://127.0.0.1:2375
            - name: HOME
              value: /home/developer
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - SYS_PTRACE
          resources:
            requests:
              cpu: "750m"
              memory: 3Gi
            limits:
              cpu: "4"
              memory: 8Gi
          readinessProbe:
            tcpSocket:
              port: ssh
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: ssh
            initialDelaySeconds: 15
            periodSeconds: 20
          volumeMounts:
            - name: home
              mountPath: /home/developer
              subPath: home
            - name: authorized-keys
              mountPath: /etc/ssh-authorized-keys
              readOnly: true
        - name: dind
          image: docker:27-dind
          imagePullPolicy: IfNotPresent
          args:
            - --host=tcp://0.0.0.0:2375
            - --tls=false
          env:
            - name: DOCKER_TLS_CERTDIR
              value: ""
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: "250m"
              memory: 1Gi
            limits:
              cpu: "2"
              memory: 4Gi
          readinessProbe:
            tcpSocket:
              port: 2375
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: home
              mountPath: /var/lib/docker
              subPath: docker
            - name: dind-run
              mountPath: /var/run
      volumes:
        - name: authorized-keys
          configMap:
            name: cursor-devbox-authorized-keys
        - name: dind-run
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: home
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: local-storage
        resources:
          requests:
            storage: 30Gi