apiVersion: apps/v1
kind: Deployment
metadata:
  name: ssh-reverse-tunnel
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ssh-reverse-tunnel
  template:
    metadata:
      labels:
        app: ssh-reverse-tunnel
    spec:
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: ssh-writable
          emptyDir: {}
        - name: ssh-key
          secret:
            secretName: ssh-id-rsa
            items:
              - key: id_rsa
                path: id_rsa
      containers:
        - name: tunnel
          image: registry.spiritofweb.ru/ssh-tunnel:2
          # ports:
            # - name: socks5-tcp
            #   containerPort: 1080
            #   protocol: TCP
            # - name: mongo-tcp
            #   containerPort: 27017
            #   protocol: TCP
          env:
            - name: REMOTE_USER
              valueFrom:
                secretKeyRef:
                  name: ssh-creds
                  key: username
            - name: REMOTE_HOST
              valueFrom:
                secretKeyRef:
                  name: ssh-creds
                  key: remote_host
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu

              mkdir -p /root/.ssh
              printf "Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n" > /root/.ssh/config
              chmod 600 /root/.ssh/config

              cp /tmp/ssh-id/id_rsa /root/.ssh/id_rsa
              chmod 600 /root/.ssh/id_rsa

              exec autossh -M 0 -N \
                -o "ServerAliveInterval=30" \
                -o "ExitOnForwardFailure=yes" \
                -o "StrictHostKeyChecking=no" \
                -o "UserKnownHostsFile=/dev/null" \
                -i /root/.ssh/id_rsa \
                -R 30300:10.1.77.0:30300 \
                "${REMOTE_USER}@${REMOTE_HOST}"
          volumeMounts:
            - name: ssh-writable
              mountPath: /root/.ssh
            - name: ssh-key
              mountPath: /tmp/ssh-id
              readOnly: true
          resources:
            limits:
              cpu: "100m"
              memory: "128Mi"
      restartPolicy: Always
# ---
# apiVersion: v1
# kind: Service
# metadata:
#   name: kultmost-ssh
#   namespace: kultmost
# spec:
#   selector:
#     app: ssh-reverse-tunnel
#   ports:
#     - name: mongo-tcp
#       protocol: TCP
#       port: 27017
#       targetPort: 27017
#       nodePort: 30670

#   type: NodePort