# Apply: kubectl apply -f manifests/me-nik4nao-com/me-nik4nao-com.yaml
# Delete: kubectl delete -f manifests/me-nik4nao-com/me-nik4nao-com.yaml
# Description: me.nik4nao.com (terminal-style personal site) deployment, service, TLS certificate, and public IngressRoute. Same pattern as manifests/portfolio.
---
apiVersion: v1
kind: Namespace
metadata:
  name: me-nik4nao-com
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: me-nik4nao-com
  namespace: me-nik4nao-com
spec:
  replicas: 1
  selector:
    matchLabels:
      app: me-nik4nao-com
  template:
    metadata:
      labels:
        app: me-nik4nao-com
    spec:
      imagePullSecrets:
        - name: gitea-registry
      containers:
        - name: me-nik4nao-com
          image: gitea.nik4nao.com/nik/me.nik4nao.com:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: me-nik4nao-com
  namespace: me-nik4nao-com
spec:
  selector:
    app: me-nik4nao-com
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: me-nik4nao-com-tls
  namespace: me-nik4nao-com
spec:
  secretName: me-nik4nao-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - me.nik4nao.com
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: me-nik4nao-com
  namespace: me-nik4nao-com
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`me.nik4nao.com`)
      kind: Rule
      middlewares:
        - name: me-nik4nao-com-ratelimit
      services:
        - name: me-nik4nao-com
          port: 80
  tls:
    secretName: me-nik4nao-com-tls
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: me-nik4nao-com-ratelimit
  namespace: me-nik4nao-com
spec:
  rateLimit:
    average: 50
    burst: 100
    period: 1m
    sourceCriterion:
      ipStrategy:
        depth: 1