# Der Namespace "artista" wird einmalig von Hand angelegt:
#   kubectl create namespace artista
#   kubectl label namespace artista pod-security.kubernetes.io/enforce=restricted
#
# Nicht geheime Einstellungen. Geheimnisse: k8s/secret.example.yaml.
apiVersion: v1
kind: ConfigMap
metadata:
  name: artista-modelcamp-config
data:
  APP_ENV: "production"
  APP_URL: "https://modelcamp.example.org"
  DATABASE_POOL_SIZE: "10"
  MAIL_TRANSPORT: "smtp"
  MAIL_FROM: "ARTISTA MODELCAMP <buchung@example.org>"
  ADMIN_NOTIFY_EMAIL: ""
  SMTP_PORT: "587"
  SMTP_SECURE: "false"
  MEDIA_DIR: "/app/media"
  EXTERNAL_VIDEO_PROVIDER: "none"
---
# Die Datenbank ist nur fuer Pods mit dem Label artista/db-client erreichbar
# (App inkl. Migrations-initContainer, Worker).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: artista-modelcamp-postgres-access
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: artista-modelcamp-postgres
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              artista/db-client: "true"
      ports:
        - port: 5432