apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: cloudflared
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cloudflared
  template:
    metadata:
      labels:
        app: cloudflared
    spec:
      # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
      # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
      # with "certificate signed by unknown authority". Same pattern as
      # authentik-values.yaml: merge the system bundle with homelab-ca.crt.
      initContainers:
        - name: merge-ca-certs
          image: debian:bookworm
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsUser: 0
          command:
            - sh
            - -c
            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
          volumeMounts:
            - name: homelab-ca
              mountPath: /homelab-ca
              readOnly: true
            - name: merged-ca
              mountPath: /merged
      volumes:
        - name: config
          configMap:
            name: cloudflared-config
        - name: credentials
          secret:
            secretName: cloudflared-credentials
        - name: homelab-ca
          configMap:
            name: homelab-ca
        - name: merged-ca
          emptyDir: {}
      containers:
        - name: cloudflared
          image: cloudflare/cloudflared:latest
          args:
            - tunnel
            - --no-autoupdate
            - --protocol
            - http2
            - --config
            - /etc/cloudflared/config.yml
            - run
          env:
            - name: SSL_CERT_FILE
              value: /merged/ca-bundle.crt
          volumeMounts:
            - name: config
              mountPath: /etc/cloudflared/config.yml
              subPath: config.yml
              readOnly: true
            - name: credentials
              mountPath: /etc/cloudflared/creds
              readOnly: true
            - name: merged-ca
              mountPath: /merged
              readOnly: true
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 128Mi