---
apiVersion: v1
kind: Secret
metadata:
  name: documenso-env
  namespace: documenso
type: Opaque
stringData:
  NEXTAUTH_URL: "https://signing.expertfab.de"
  NEXTAUTH_SECRET: "KB23sNTjQgqLNcH5ySfbCS+W+yK5KU7SigmPOMPPOk0="
  NEXT_PUBLIC_WEBAPP_URL: "https://signing.expertfab.de"
  NEXT_PRIVATE_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
  NEXT_PRIVATE_DIRECT_DATABASE_URL: "postgres://documenso:9QtScsD5IymypPxR2eMNFoMFYVUp7cL@documenso-postgres:5432/documenso"
  NEXT_PRIVATE_ENCRYPTION_KEY: "11d8ecb4ad0ec906f8ba4694ade72f4c8f1764810395c95c7d8ca275fd700ad0"
  NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY: "496a5868e588c1119a9bfaae687167630eb46f5fbee7295177e91ac386b5c927"
  NEXT_PUBLIC_UPLOAD_TRANSPORT: "database"
  NEXT_PRIVATE_SMTP_TRANSPORT: "smtp-auth"
  NEXT_PRIVATE_SMTP_HOST: "smtprelay.expertfab.de"
  NEXT_PRIVATE_SMTP_PORT: "587"
  NEXT_PRIVATE_SMTP_SECURE: "false"
  NEXT_PRIVATE_SMTP_USERNAME: "it-admin@expertfab.de"
  NEXT_PRIVATE_SMTP_PASSWORD: "Relay22$$"
  NEXT_PRIVATE_SMTP_FROM_NAME: "ExpertFab Documenso"
  NEXT_PRIVATE_SMTP_FROM_ADDRESS: "it-admin@expertfab.de"
  NEXT_PRIVATE_SIGNING_TRANSPORT: "local"
  NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH: "/opt/documenso/cert.p12"
  NEXT_PRIVATE_SIGNING_PASSPHRASE: "documenso"
  PORT: "3000"
---
apiVersion: v1
kind: Secret
metadata:
  name: documenso-signing-cert
  namespace: documenso
type: Opaque
data:
  # Self-signed P12 generated on 2026-05-22, passphrase: documenso
  cert.p12: [encoded data, 6096 characters]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: documenso
  namespace: documenso
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: documenso
  template:
    metadata:
      labels:
        app: documenso
    spec:
      containers:
        - name: documenso
          image: documenso/documenso:latest
          ports:
            - containerPort: 3000
          envFrom:
            - secretRef:
                name: documenso-env
          volumeMounts:
            - name: signing-cert
              mountPath: /opt/documenso/cert.p12
              subPath: cert.p12
              readOnly: true
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 6
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 90
            periodSeconds: 30
            failureThreshold: 5
          resources:
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              cpu: 1000m
              memory: 1500Mi
      volumes:
        - name: signing-cert
          secret:
            secretName: documenso-signing-cert
            items:
              - key: cert.p12
                path: cert.p12
---
apiVersion: v1
kind: Service
metadata:
  name: documenso
  namespace: documenso
spec:
  selector:
    app: documenso
  ports:
    - port: 3000
      targetPort: 3000
