# API — the FastAPI service (SSE chat, WS voice, ingest/query/health). Stateless
# against Qdrant, so it scales horizontally; HPA in hpa.yaml. The browser reaches
# it only via the web /api proxy + ingress, so it's a ClusterIP (not public).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: auralynq-api
  namespace: auralynq
  labels: { app.kubernetes.io/name: auralynq-api, app.kubernetes.io/part-of: auralynq }
spec:
  replicas: 2
  selector:
    matchLabels: { app.kubernetes.io/name: auralynq-api }
  template:
    metadata:
      labels: { app.kubernetes.io/name: auralynq-api, app.kubernetes.io/part-of: auralynq }
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
      containers:
        - name: api
          image: ghcr.io/mhhamdan/auralynq-api:0.1.0
          args: ["uvicorn", "auralynq.serving.app:app", "--host", "0.0.0.0", "--port", "8000"]
          ports:
            - { name: http, containerPort: 8000 }
          envFrom:
            - configMapRef: { name: auralynq-config }
            - secretRef: { name: auralynq-secrets }
          startupProbe:        # allow slow first-time model/index work
            httpGet: { path: /health, port: 8000 }
            failureThreshold: 30
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /health, port: 8000 }
            periodSeconds: 15
          readinessProbe:       # /ready -> 503 until the index is queryable
            httpGet: { path: /ready, port: 8000 }
            periodSeconds: 10
          resources:
            requests: { cpu: "250m", memory: "512Mi" }
            limits: { cpu: "2", memory: "2Gi" }
          securityContext:
            allowPrivilegeEscalation: false
---
apiVersion: v1
kind: Service
metadata:
  name: auralynq-api
  namespace: auralynq
  labels: { app.kubernetes.io/name: auralynq-api, app.kubernetes.io/part-of: auralynq }
spec:
  selector: { app.kubernetes.io/name: auralynq-api }
  ports:
    - { name: http, port: 8000, targetPort: 8000 }