{
  "apiVersion": "apps/v1",
  "kind": "Deployment",
  "metadata": {
    "labels": {
      "app": "updatecenter-web",
      "app.kubernetes.io/name": "updatecenter-web",
      "app.kubernetes.io/part-of": "flowercore"
    },
    "name": "updatecenter-web",
    "namespace": "fc-updater"
  },
  "spec": {
    "progressDeadlineSeconds": 600,
    "replicas": 1,
    "revisionHistoryLimit": 3,
    "selector": {
      "matchLabels": {
        "app": "updatecenter-web"
      }
    },
    "strategy": {
      "type": "Recreate"
    },
    "template": {
      "metadata": {
        "annotations": {
          "fc.flowercore.io/healthz-anon": "true",
          "fc.flowercore.io/probe-path": "/",
          "kubectl.kubernetes.io/restartedAt": "2026-05-04T23:35:59-05:00"
        },
        "labels": {
          "app": "updatecenter-web"
        }
      },
      "spec": {
        "containers": [
          {
            "env": [
              {
                "name": "ASPNETCORE_URLS",
                "value": "http://+:8080"
              },
              {
                "name": "FlowerCore__Updater__Database__Provider",
                "value": "sqlite"
              },
              {
                "name": "FlowerCore__Updater__Database__ConnectionString",
                "value": "Data Source=/data/updatecenter.db"
              },
              {
                "name": "FlowerCore__Updater__BundleStorage__LocalFs__RootDirectory",
                "value": "/data/bundles"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__RequirePublicVisibilityOnPublicHosts",
                "value": "true"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__Code",
                "value": "8f3c2a9e7d41"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__AppId",
                "value": "flowercore.faith-ai-mike"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__Channel",
                "value": "stable"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__RuntimeId",
                "value": "win-x64"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__DisplayName",
                "value": "Faith AI Mike Edition"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__Headline",
                "value": "Faith AI Mike Edition"
              },
              {
                "name": "FlowerCore__Updater__PublicShares__Links__0__Description",
                "value": "Private release link for Mike's Faith AI bundle."
              },
              {
                "name": "FlowerCore__Audit__Sinks__Loki__Enabled",
                "value": "false"
              },
              {
                "name": "FlowerCore__Updater__Auth__Bootstrap__Enabled",
                "value": "true"
              },
              {
                "name": "FlowerCore__Updater__Auth__Bootstrap__Username",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "username",
                    "name": "updater-bootstrap-auth"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Auth__Bootstrap__Password",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "password",
                    "name": "updater-bootstrap-auth"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Auth__Bootstrap__SigningKey",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "signing-key",
                    "name": "updater-bootstrap-auth"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Signing__AutoSignOnPublish",
                "value": "true"
              },
              {
                "name": "FlowerCore__Updater__Signing__RequireSignatureOnPublish",
                "value": "true"
              },
              {
                "name": "FlowerCore__Updater__Signing__PfxBase64",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "pfx-base64",
                    "name": "updater-signing"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Signing__PfxPassword",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "pfx-password",
                    "name": "updater-signing"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Signing__OpItemReference",
                "value": "op://FlowerCore/step-ca-codesign"
              },
              {
                "name": "FlowerCore__Updater__Signing__TrustAnchorPath",
                "value": "/etc/flowercore-updater/signing/root-ca.pem"
              },
              {
                "name": "FlowerCore__Updater__GitHub__Token",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "github-token",
                    "name": "updater-webhooks"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__GitHub__WebhookSecret",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "github-webhook-secret",
                    "name": "updater-webhooks"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Gitea__Token",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "gitea-token",
                    "name": "updater-webhooks"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__Gitea__WebhookSecret",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "gitea-webhook-secret",
                    "name": "updater-webhooks"
                  }
                }
              },
              {
                "name": "FlowerCore__Updater__BundleStorage__LocalFs__MaxTotalBytes",
                "value": "26843545600"
              }
            ],
            "image": "localhost/fc-updater-web:v20260617-sec5-913c6a9",
            "imagePullPolicy": "Never",
            "securityContext": {
              "allowPrivilegeEscalation": false,
              "capabilities": {
                "drop": [
                  "ALL"
                ]
              }
            },
            "livenessProbe": {
              "failureThreshold": 3,
              "initialDelaySeconds": 30,
              "periodSeconds": 30,
              "successThreshold": 1,
              "tcpSocket": {
                "port": "http"
              },
              "timeoutSeconds": 1
            },
            "name": "web",
            "ports": [
              {
                "containerPort": 8080,
                "name": "http",
                "protocol": "TCP"
              }
            ],
            "readinessProbe": {
              "failureThreshold": 3,
              "initialDelaySeconds": 10,
              "periodSeconds": 15,
              "successThreshold": 1,
              "tcpSocket": {
                "port": "http"
              },
              "timeoutSeconds": 1
            },
            "resources": {},
            "terminationMessagePath": "/dev/termination-log",
            "terminationMessagePolicy": "File",
            "volumeMounts": [
              {
                "mountPath": "/data",
                "name": "data"
              },
              {
                "mountPath": "/etc/flowercore-updater/signing",
                "name": "signing",
                "readOnly": true
              }
            ]
          }
        ],
        "dnsPolicy": "ClusterFirst",
        "restartPolicy": "Always",
        "schedulerName": "default-scheduler",
        "securityContext": {
          "fsGroup": 1654,
          "fsGroupChangePolicy": "OnRootMismatch",
          "runAsGroup": 1654,
          "runAsNonRoot": true,
          "runAsUser": 1654
        },
        "terminationGracePeriodSeconds": 30,
        "volumes": [
          {
            "name": "data",
            "persistentVolumeClaim": {
              "claimName": "updatecenter-data"
            }
          },
          {
            "name": "signing",
            "secret": {
              "defaultMode": 420,
              "items": [
                {
                  "key": "root-ca.pem",
                  "path": "root-ca.pem"
                }
              ],
              "secretName": "updater-signing"
            }
          }
        ]
      }
    }
  }
}