apiVersion: apps/v1
kind: Deployment
metadata:
  name: axon
  labels:
    {{- include "axon.labels" . | nindent 4 }}
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "axon.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "axon.selectorLabels" . | nindent 8 }}
    spec:
      {{- if .Values.image.pullSecretName }}
      imagePullSecrets:
        - name: {{ .Values.image.pullSecretName }}
      {{- end }}
      {{- if ne (.Values.axon.provider | default "claude") "vllm" }}
      initContainers:
        - name: copy-credentials
          image: busybox:1.36
          command: ["sh", "-c", "cp /secret/.credentials.json /claude-home/ && chmod 600 /claude-home/.credentials.json && mkdir -p /claude-home/debug"]
          volumeMounts:
            - name: claude-auth-secret
              mountPath: /secret
              readOnly: true
            - name: claude-home
              mountPath: /claude-home
          securityContext:
            runAsNonRoot: true
            runAsUser: 1001
      {{- end }}
      containers:
        - name: axon
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - containerPort: {{ .Values.axon.port }}
              protocol: TCP
          env:
            - name: HOME
              value: /home/axon
            - name: AXON_PORT
              value: "{{ .Values.axon.port }}"
            - name: AXON_PROVIDER
              value: "{{ .Values.axon.provider | default "claude" }}"
            - name: AXON_DEFAULT_MODEL
              value: "{{ .Values.axon.defaultModel }}"
            - name: AXON_POOL_SIZE
              value: "{{ .Values.axon.poolSize }}"
            - name: AXON_CONVERSATION_TTL
              value: "{{ .Values.axon.conversationTtl }}"
            {{- if .Values.valkey.enabled }}
            - name: AXON_VALKEY_URL
              value: "redis://axon-valkey:6379"
            {{- end }}
            - name: AXON_API_KEYS
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.axon.existingSecret }}
                  key: AXON_API_KEYS
            {{- if eq (.Values.axon.provider | default "claude") "vllm" }}
            - name: AXON_VLLM_BASE_URL
              value: "{{ .Values.axon.vllm.baseUrl }}"
            - name: AXON_VLLM_DEFAULT_MODEL
              value: "{{ .Values.axon.vllm.defaultModel | default "qwen3-coder" }}"
            - name: AXON_VLLM_API_KEY
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.axon.vllm.existingSecret }}
                  key: AXON_VLLM_API_KEY
            {{- end }}
          {{- if ne (.Values.axon.provider | default "claude") "vllm" }}
          volumeMounts:
            - name: claude-home
              mountPath: /home/axon/.claude
          {{- end }}
          resources:
            {{- toYaml .Values.resources.axon | nindent 12 }}
          livenessProbe:
            httpGet:
              path: /health
              port: {{ .Values.axon.port }}
            initialDelaySeconds: 30
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /health
              port: {{ .Values.axon.port }}
            initialDelaySeconds: 10
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
            runAsUser: 1001
      {{- if ne (.Values.axon.provider | default "claude") "vllm" }}
      volumes:
        - name: claude-auth-secret
          secret:
            secretName: {{ .Values.axon.claudeAuthSecret }}
        - name: claude-home
          emptyDir: {}
      {{- end }}
