apiVersion: apps/v1
kind: Deployment
metadata:
  name: neuron-web
  namespace: neuron-web
  labels:
    app: neuron-web
    env: stage
spec:
  replicas: 1
  selector:
    matchLabels:
      app: neuron-web
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app: neuron-web
        env: stage
    spec:
      # The registry currently allows anonymous reads from the cluster; if we
      # later flip it to require auth, add a registry-pull-secret here that
      # ESO populates from Vault. See the mudcraft externalsecret-registry
      # for the pattern.
      containers:
        - name: neuron-web
          image: registry.neuralplatform.ai/neuron-web:dev-dfe41234
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: NODE_ENV
              value: production
            - name: PORT
              value: "8080"
            - name: NEURON_PORT
              value: "7772"
            - name: LANDING_ROOT
              value: /srv/landing
            # Public Cloud Run env that the El runtime reads at startup.
            - name: NEURON_LLM_0_FORMAT
              value: anthropic
            - name: NEURON_LLM_0_MODEL
              value: claude-sonnet-4-5
            - name: NEURON_LLM_0_URL
              value: https://api.anthropic.com/v1/messages
            - name: GCS_SHARE_BUCKET
              value: neuron-shares-prod
            - name: NEURON_ORIGIN
              value: https://web-stage.neuralplatform.ai
          envFrom:
            - secretRef:
                name: neuron-web-secrets
          # The El runtime fs_writes index.html, about.html, terms.html,
          # enterprise-terms.html into LANDING_ROOT at startup. The image
          # ships a baseline /srv/landing layout (assets, llms.txt) but
          # the HTML files are runtime-generated. Mount a writable
          # emptyDir over /srv/landing so the runtime can write, while
          # keeping the image's static layout via subPath copies — but
          # since the image already chowns /srv/landing to the landing
          # user, no overlay is needed for normal operation. The
          # readOnlyRootFilesystem flag is intentionally NOT set so
          # /srv/landing stays writable.
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]