apiVersion: v1
kind: ConfigMap
metadata:
  name: cn-fillcode-proxy
  namespace: apps
data:
  default.conf: |
    server {
      listen 80;
      server_name cn.fillcode.com;
      return 308 https://cn.fillcode.com$request_uri;
    }

    server {
      listen 443 ssl;
      server_name cn.fillcode.com;

      ssl_certificate /etc/nginx/tls/tls.crt;
      ssl_certificate_key /etc/nginx/tls/tls.key;
      ssl_protocols TLSv1.2 TLSv1.3;

      resolver 169.254.20.10 10.43.0.10 valid=30s ipv6=off;

      location / {
        set $fillcode_origin https://fillcode.com;
        proxy_pass $fillcode_origin$request_uri;
        proxy_ssl_server_name on;
        proxy_ssl_name fillcode.com;
        proxy_set_header Host fillcode.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect https://fillcode.com/ https://cn.fillcode.com/;
      }
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cn-fillcode-proxy
  namespace: apps
spec:
  replicas: 1
  revisionHistoryLimit: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: cn-fillcode-proxy
  template:
    metadata:
      labels:
        app.kubernetes.io/name: cn-fillcode-proxy
    spec:
      automountServiceAccountToken: false
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        kubernetes.io/hostname: hwa
      containers:
        - name: nginx
          image: docker.io/library/nginx:1.31.4-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/conf.d
              readOnly: true
            - name: tls
              mountPath: /etc/nginx/tls
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: cn-fillcode-proxy
        - name: tls
          secret:
            secretName: fillcode-com-crt