{
  "apiVersion": "apps/v1",
  "kind": "Deployment",
  "metadata": {
    "labels": {
      "app": "fc-devicemgmt-web",
      "app.kubernetes.io/component": "web",
      "app.kubernetes.io/managed-by": "argocd",
      "app.kubernetes.io/name": "fc-devicemgmt-web",
      "app.kubernetes.io/part-of": "flowercore",
      "flowercore.io/created-by": "bluejay-infra",
      "flowercore.io/tenant-id": "system"
    },
    "name": "fc-devicemgmt-web",
    "namespace": "fc-devicemgmt"
  },
  "spec": {
    "progressDeadlineSeconds": 600,
    "replicas": 1,
    "revisionHistoryLimit": 3,
    "selector": {
      "matchLabels": {
        "app": "fc-devicemgmt-web"
      }
    },
    "strategy": {
      "rollingUpdate": {
        "maxSurge": 0,
        "maxUnavailable": 1
      },
      "type": "RollingUpdate"
    },
    "template": {
      "metadata": {
        "annotations": {
          "fc.flowercore.io/healthz-anon": "true",
          "fc.flowercore.io/probe-path": "/healthz",
          "flowercore.io/audit-trace-id": "runtime-activity-trace",
          "kubectl.kubernetes.io/restartedAt": "2026-05-20T11:29:46-05:00",
          "operator.1password.io/last-restarted": "2026-05-20T16:29:03Z",
          "prometheus.io/path": "/metrics",
          "prometheus.io/port": "8080",
          "prometheus.io/scrape": "true"
        },
        "labels": {
          "app": "fc-devicemgmt-web",
          "app.kubernetes.io/component": "web",
          "app.kubernetes.io/managed-by": "argocd",
          "app.kubernetes.io/name": "fc-devicemgmt-web",
          "app.kubernetes.io/part-of": "flowercore",
          "flowercore.io/created-by": "bluejay-infra",
          "flowercore.io/tenant-id": "system"
        }
      },
      "spec": {
        "containers": [
          {
            "env": [
              {
                "name": "ASPNETCORE_URLS",
                "value": "http://+:8080"
              },
              {
                "name": "ASPNETCORE_ENVIRONMENT",
                "value": "Production"
              },
              {
                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
                "value": "false"
              },
              {
                "name": "HOME",
                "value": "/data"
              },
              {
                "name": "FlowerCore__Service__Name",
                "value": "FlowerCore.DeviceManagement.Web"
              },
              {
                "name": "FlowerCore__DeviceManagement__DefaultTenantId",
                "value": "system"
              },
              {
                "name": "FlowerCore__Database__Provider",
                "value": "Sqlite"
              },
              {
                "name": "FlowerCore__Database__ConnectionStrings__Sqlite",
                "value": "Data Source=/data/devicemgmt.db"
              },
              {
                "name": "FlowerCore__Database__Password",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "DB-Password",
                    "name": "fc-devicemgmt-runtime"
                  }
                }
              },
              {
                "name": "FlowerCore__EventBus__Redis__Configuration",
                "value": "redis.fc-redis.svc:6379"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__Enabled",
                "value": "true"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__GatewayMode",
                "value": "nanohub"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__NanoHubBaseUrl",
                "value": "http://fc-apple-mdm.fc-apple-mdm.svc"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__NanoHubApiUserName",
                "value": "nanohub"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__NanoHubNanoMdmApiPath",
                "value": "/api/v1/nanomdm/"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__EnrollmentProfileDownloadUrl",
                "value": "https://devices.iamworkin.lan/api/v1/apple-mdm/enrollment-profile.mobileconfig"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__MdmServerUrl",
                "value": "https://mdm.iamworkin.lan/mdm"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__MdmCheckInUrl",
                "value": "https://mdm.iamworkin.lan/checkin"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__Organization",
                "value": "FlowerCore"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__EnrollmentDisplayName",
                "value": "FlowerCore Apple MDM"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ScepName",
                "value": "FlowerCore Apple MDM Device Identity"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__TrustAnchorDisplayName",
                "value": "IAmWorkin ACME CA Root CA"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__TrustAnchorCertificatePem",
                "value": "-----BEGIN CERTIFICATE-----\nMIIBxDCCAWqgAwIBAgIRAPY357G6ow6zMAL5+4bS2kkwCgYIKoZIzj0EAwIwQDEa\nMBgGA1UEChMRSUFtV29ya2luIEFDTUUgQ0ExIjAgBgNVBAMTGUlBbVdvcmtpbiBB\nQ01FIENBIFJvb3QgQ0EwHhcNMjYwMzA4MTgwNzExWhcNMzYwMzA1MTgwNzExWjBA\nMRowGAYDVQQKExFJQW1Xb3JraW4gQUNNRSBDQTEiMCAGA1UEAxMZSUFtV29ya2lu\nIEFDTUUgQ0EgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJ2n04X1\nJZo5Zdq/i1Idv8+fqwZyAzBh7whbqj0SWsJL8UWRabCMqYCs7+dXO0xRSzqkwFDL\nx+vooOai8RgRNhajRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgEBMB0GA1UdDgQWBBRnuPPQR6iM/H6vOluiU3Sygayz8jAKBggqhkjOPQQDAgNI\nADBFAiEArQK9dYPGmAZsdYnjziuFVVE5NKZUcceYvGfGC+tLXUsCIAudF2zJrCRq\n3mK50ZZET/fwTkJwiEF4824mjP8p1CKM\n-----END CERTIFICATE-----"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__NanoHubApiKey",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "NANOHUB_API_KEY",
                    "name": "fc-devicemgmt-runtime"
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ApnsTopic",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_APNS_TOPIC",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ScepUrl",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_SCEP_URL",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ScepChallenge",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_SCEP_CHALLENGE",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ProfileSigningCertificatePem",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_PROFILE_SIGNING_CERTIFICATE_PEM",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ProfileSigningPrivateKeyPem",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_PROFILE_SIGNING_PRIVATE_KEY_PEM",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__RequireManagedWifiPayload",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_REQUIRE_MANAGED_WIFI_PAYLOAD",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ManagedWifiSsid",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_MANAGED_WIFI_SSID",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ManagedWifiPassword",
                "valueFrom": {
                  "secretKeyRef": {
                    "key": "APPLE_MDM_MANAGED_WIFI_PASSWORD",
                    "name": "fc-devicemgmt-runtime",
                    "optional": true
                  }
                }
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ManagedWifiEncryptionType",
                "value": "WPA2"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ManagedWifiAutoJoin",
                "value": "true"
              },
              {
                "name": "FlowerCore__DeviceManagement__AppleMdm__ManagedWifiDisableAssociationMacRandomization",
                "value": "true"
              }
            ],
            "image": "localhost/fc-devicemgmt-web:v20260618-mdmprofile-d0d2a56",
            "imagePullPolicy": "Never",
            "livenessProbe": {
              "failureThreshold": 3,
              "initialDelaySeconds": 30,
              "periodSeconds": 30,
              "successThreshold": 1,
              "tcpSocket": {
                "port": 8080
              },
              "timeoutSeconds": 1
            },
            "name": "web",
            "ports": [
              {
                "containerPort": 8080,
                "name": "http",
                "protocol": "TCP"
              }
            ],
            "readinessProbe": {
              "failureThreshold": 3,
              "periodSeconds": 10,
              "successThreshold": 1,
              "tcpSocket": {
                "port": 8080
              },
              "timeoutSeconds": 1
            },
            "resources": {
              "limits": {
                "cpu": "1",
                "memory": "768Mi"
              },
              "requests": {
                "cpu": "100m",
                "memory": "256Mi"
              }
            },
            "securityContext": {
              "allowPrivilegeEscalation": false,
              "capabilities": {
                "drop": [
                  "ALL"
                ]
              },
              "readOnlyRootFilesystem": true,
              "runAsGroup": 1654,
              "runAsNonRoot": true,
              "runAsUser": 1654
            },
            "startupProbe": {
              "failureThreshold": 30,
              "initialDelaySeconds": 5,
              "periodSeconds": 5,
              "successThreshold": 1,
              "tcpSocket": {
                "port": 8080
              },
              "timeoutSeconds": 1
            },
            "terminationMessagePath": "/dev/termination-log",
            "terminationMessagePolicy": "File",
            "volumeMounts": [
              {
                "mountPath": "/data",
                "name": "data"
              },
              {
                "mountPath": "/tmp",
                "name": "tmp"
              },
              {
                "mountPath": "/app/logs",
                "name": "logs"
              }
            ]
          }
        ],
        "dnsPolicy": "ClusterFirst",
        "restartPolicy": "Always",
        "schedulerName": "default-scheduler",
        "securityContext": {
          "fsGroup": 1654,
          "fsGroupChangePolicy": "OnRootMismatch"
        },
        "terminationGracePeriodSeconds": 30,
        "volumes": [
          {
            "name": "data",
            "persistentVolumeClaim": {
              "claimName": "fc-devicemgmt-web-data"
            }
          },
          {
            "emptyDir": {},
            "name": "tmp"
          },
          {
            "emptyDir": {},
            "name": "logs"
          }
        ]
      }
    }
  }
}