# Apps do tenant escolinha:
#  - backend: Spring Boot OAuth2 Resource Server (imagem athletic-map-backend:1.0, importada no k3s)
#  - frontend: SPA OIDC Authorization Code + PKCE (keycloak-js) chamando /api/me
#  - bff: stub (whoami) — sera substituido na evolucao
---
apiVersion: apps/v1
kind: Deployment
metadata: { name: backend, namespace: escolinha-prod, labels: { app: backend } }
spec:
  replicas: 1
  selector: { matchLabels: { app: backend } }
  template:
    metadata: { labels: { app: backend } }
    spec:
      containers:
        - name: backend
          image: docker.io/library/athletic-map-backend:1.3
          imagePullPolicy: Never
          env:
            - { name: ATM_JWK_SET_URI, value: "http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs" }
            - { name: ATM_ISSUER, value: "https://auth-escolinha.athleticmap.influxdigital.com.br/realms/athleticmap" }
            - { name: ATM_TENANT, value: "escolinha" }
          ports: [{ containerPort: 8083 }]
          readinessProbe:
            httpGet: { path: /api/public/health, port: 8083 }
            initialDelaySeconds: 20
            periodSeconds: 10
            failureThreshold: 24
---
apiVersion: v1
kind: Service
metadata: { name: backend, namespace: escolinha-prod, labels: { app: backend } }
spec:
  selector: { app: backend }
  ports: [{ name: http, port: 80, targetPort: 8083 }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: escolinha
  namespace: escolinha-prod
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    traefik.ingress.kubernetes.io/router.middlewares: escolinha-prod-redirect-https@kubernetescrd
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - escolinha.athleticmap.influxdigital.com.br
        - auth-escolinha.athleticmap.influxdigital.com.br
      secretName: escolinha-tls
  rules:
    - host: escolinha.athleticmap.influxdigital.com.br
      http:
        paths:
          - { path: /api/configuracao, pathType: Prefix, backend: { service: { name: servico-configuracao, port: { number: 80 } } } }
          - { path: /api/cadastro, pathType: Prefix, backend: { service: { name: servico-cadastro, port: { number: 80 } } } }
          - { path: /bff, pathType: Prefix, backend: { service: { name: servico-bff, port: { number: 80 } } } }
          - { path: /api/organizacao, pathType: Prefix, backend: { service: { name: servico-organizacao, port: { number: 80 } } } }
          - { path: /api/planejamento, pathType: Prefix, backend: { service: { name: servico-planejamento, port: { number: 80 } } } }
          - { path: /api/campeonato, pathType: Prefix, backend: { service: { name: servico-campeonato, port: { number: 80 } } } }
          - { path: /api/saude, pathType: Prefix, backend: { service: { name: servico-saude, port: { number: 80 } } } }
          - { path: /api/financeiro, pathType: Prefix, backend: { service: { name: servico-financeiro, port: { number: 80 } } } }
          - { path: /api/documentos, pathType: Prefix, backend: { service: { name: servico-documentos, port: { number: 80 } } } }
          - { path: /api/administrativo, pathType: Prefix, backend: { service: { name: servico-administrativo, port: { number: 80 } } } }
          - { path: /api/assistencia-social, pathType: Prefix, backend: { service: { name: servico-assistencia-social, port: { number: 80 } } } }
          - { path: /api/pedagogico, pathType: Prefix, backend: { service: { name: servico-pedagogico, port: { number: 80 } } } }
          - { path: /api/nutricao, pathType: Prefix, backend: { service: { name: servico-nutricao, port: { number: 80 } } } }
          - { path: /api/agenda, pathType: Prefix, backend: { service: { name: servico-agenda, port: { number: 80 } } } }
          - { path: /api, pathType: Prefix, backend: { service: { name: backend, port: { number: 80 } } } }
          - { path: /, pathType: Prefix, backend: { service: { name: frontend-spa, port: { number: 80 } } } }
    - host: auth-escolinha.athleticmap.influxdigital.com.br
      http:
        paths:
          - { path: /, pathType: Prefix, backend: { service: { name: keycloak, port: { number: 8080 } } } }