apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: cursor-devbox
  namespace: cursor-devbox
spec:
  serviceName: cursor-devbox
  replicas: 1
  selector:
    matchLabels:
      app: cursor-devbox
  template:
    metadata:
      labels:
        app: cursor-devbox
      annotations:
        linkerd.io/inject: disabled
    spec:
      terminationGracePeriodSeconds: 30
      imagePullSecrets:
        - name: dcr-registry-auth-ro
      containers:
        - name: ssh
          image: dcr.trinitysan.by/infra/cursor-devbox:5-e820b1ebd2476afa323a669bf91a8e09472ed2dd # {"$imagepolicy": "flux-system:cursor-devbox"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: ssh
              containerPort: 22
            - name: http
              containerPort: 8080
          env:
            - name: DOCKER_HOST
              value: tcp://127.0.0.1:2375
            - name: HOME
              value: /home/developer
            - name: HTTP_PROXY
              value: socks5h://node2-socks5.egress-proxy.svc.clusterset.local:1080
            - name: HTTPS_PROXY
              value: socks5h://node2-socks5.egress-proxy.svc.clusterset.local:1080
          securityContext:
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - SYS_PTRACE
          resources:
            requests:
              cpu: "750m"
              memory: 3Gi
            limits:
              cpu: "4"
              memory: 8Gi
          # startupProbe covers slow first boot (sshd after host-key/auth setup).
          startupProbe:
            tcpSocket:
              port: ssh
            failureThreshold: 60
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: ssh
            periodSeconds: 10
          livenessProbe:
            tcpSocket:
              port: ssh
            periodSeconds: 20
          volumeMounts:
            - name: home
              mountPath: /home/developer
              subPath: home
            - name: authorized-keys
              mountPath: /etc/ssh-authorized-keys
              readOnly: true
        - name: dind
          image: docker:27-dind
          imagePullPolicy: IfNotPresent
          args:
            - --host=tcp://0.0.0.0:2375
            - --tls=false
          env:
            - name: DOCKER_TLS_CERTDIR
              value: ""
          securityContext:
            privileged: true
          resources:
            requests:
              cpu: "250m"
              memory: 1Gi
            limits:
              cpu: "2"
              memory: 4Gi
          readinessProbe:
            tcpSocket:
              port: 2375
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: home
              mountPath: /var/lib/docker
              subPath: docker
            - name: dind-run
              mountPath: /var/run
      volumes:
        - name: authorized-keys
          configMap:
            name: cursor-devbox-authorized-keys
        - name: dind-run
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: home
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: local-storage
        resources:
          requests:
            storage: 30Gi