apiVersion: v1
kind: Pod
metadata:
  name: anubis-proxy
spec:
  containers:
    # Anubis container as the S3 proxy
    - name: anubis
      image: ghcr.io/techarohq/anubis:latest
      ports:
        - containerPort: 8000
          protocol: TCP
          name: anubis-port
      env:
        # https://anubis.techaro.lol/docs/admin/installation#environment-variables
        - name: BIND
          value: ":8000"
        - name: METRICS_BIND
          value: ":9099"
        - name: SERVE_ROBOTS_TXT
          value: "true"
        - name: TARGET
          value: "https://cockpit-logs.us-east-1.linodeobjects.com/"
        - name: TARGET_HOST
          value: "cockpit-logs.us-east-1.linodeobjects.com"
        - name: DIFFICULTY
          value: 6
        - name: COOKIE_EXPIRATOIN_TIME
          value: "24h"

    # Nginx as the frontend reverse proxy
    - name: nginx
      image: docker.io/nginx:stable
      ports:
        - containerPort: 443
          hostPort: 443
      volumeMounts:
        - name: nginx-config
          mountPath: /etc/nginx/conf.d/default.conf
          subPath: default.conf
        - name: tls_cert
          mountPath: /tls
          readOnly: true

  volumes:
    # Nginx configuration
    - name: nginx-config
      configMap:
        name: nginx-config
        items:
          - key: nginx-conf
            path: default.conf

    - name: tls_cert
      hostPath:
        path: /root/tls-cert
        type: Directory

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  nginx-conf: |
    server {
        listen 443 ssl;
        server_name localhost;

        ssl_certificate /tls/cert.pem;
        ssl_certificate_key /tls/key.pem;

        location / {
            # Proxy requests to anubis
            proxy_pass http://localhost:8000;

            # Set required headers including X-Real-IP
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Health check endpoint
        location /health {
            return 200 'OK';
            add_header Content-Type text/plain;
        }
    }
