apiVersion: v1
kind: Service
metadata:
  name: ipsec-vpn
  namespace: home-apps
spec:
  type: NodePort
  ports:
    - port: 500
      # nodePort: 500
      protocol: UDP
      targetPort: 500
      name: ipsec-udp-1
    - port: 4500
      # nodePort: 4500
      protocol: UDP
      targetPort: 4500
      name: ipsec-udp-2
  selector:
    app: ipsec-vpn

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ipsec-vpn
spec:
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: ipsec-vpn
  replicas: 1
  template:
    metadata:
      labels:
        app: ipsec-vpn
    spec:
      containers:
        - name: ipsec-vpn
          image: hwdsl2/ipsec-vpn-server
          env:
            - name: VPN_USER
              value: happy
            - name: VPN_IPSEC_PSK
              value: hellovpn!!
            - name: VPN_PASSWORD
              value: IfNotPresentHappy!!
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
            limits:
              cpu: 200m
              memory: 512Mi
          securityContext:
            runAsUser: 0
            privileged: true
            capabilities:
              add: ["NET_ADMIN"]
          volumeMounts:
            - name: config
              mountPath: /etc/ipsec.d
            - name: host-volumes
              mountPath: /lib/modules
          ports:
            - containerPort: 500
              protocol: UDP
            - containerPort: 4500
              protocol: UDP
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: ipsec-pvc
        - name: host-volumes
          hostPath:
            path: /lib/modules
            type: Directory
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  namespace: home-apps
  name: ipsec-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: nfs-client
  resources:
    requests:
      storage: 1Gi