# FlowerCore Brochure public host
#
# Thin Blazor host for public What's New, walkthrough, and gallery content
# carved out of FlowerCore.Intranet.Web. The ApplicationSet creates
# infra-brochure from this directory after merge.
---
apiVersion: v1
kind: Namespace
metadata:
  name: brochure
  labels:
    app.kubernetes.io/part-of: flowercore
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: brochure-web
  namespace: brochure
  labels:
    app: brochure-web
    app.kubernetes.io/name: brochure-web
    app.kubernetes.io/part-of: flowercore
spec:
  replicas: 0  # Scaled to 0 by SRE 2026-05-19; pod was running wrong codebase (Intranet.Web binary in brochure image); Sprint 34 Cx-3 to rebuild from FlowerCore.Brochure.Web source per docs/ai-agents/codex-prompts/2026-05-18-fc-brochure-web-rebuild-pack.md
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: brochure-web
  template:
    metadata:
      labels:
        app: brochure-web
        app.kubernetes.io/name: brochure-web
        app.kubernetes.io/part-of: flowercore
    spec:
      containers:
        - name: brochure-web
          image: localhost/fc-brochure-web:v20260524-sprint32
          imagePullPolicy: Never
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: ASPNETCORE_ENVIRONMENT
              value: Production
            - name: ASPNETCORE_URLS
              value: "http://+:8080"
          resources:
            requests:
              cpu: "25m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          readinessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
          securityContext:
            runAsNonRoot: true
            runAsUser: 1654
            runAsGroup: 1654
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: brochure-web
  namespace: brochure
  labels:
    app: brochure-web
    app.kubernetes.io/name: brochure-web
    app.kubernetes.io/part-of: flowercore
spec:
  type: ClusterIP
  selector:
    app: brochure-web
  ports:
    - name: http
      port: 8080
      targetPort: http
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: brochure-web-tls
  namespace: brochure
spec:
  secretName: brochure-web-tls
  issuerRef:
    name: step-ca-acme
    kind: ClusterIssuer
  dnsNames:
    - brochure.flowercore.io
  duration: 720h
  renewBefore: 240h
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: brochure-web-public
  namespace: brochure
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`brochure.flowercore.io`) && (Method(`GET`) || Method(`HEAD`))
      kind: Rule
      services:
        - name: brochure-web
          port: 8080
  tls:
    secretName: brochure-web-tls