apiVersion: v1
kind: ConfigMap
metadata:
  name: webserver-config
  labels:
    tier: backend
data:
  config :
    server {
        listen       80;
        server_name  localhost;
        location / {
            root   /usr/share/nginx/www/html;
            index  index.html index.htm;
        }
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/www/html;
        }
      location ~ .php$ {
          root /usr/share/nginx/www/html;
          try_files $uri =404;
          fastcgi_split_path_info ^(.+.php)(/.+)$;
          fastcgi_pass phpfpm:9000;
          fastcgi_index index.php;
          include fastcgi_params;
          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
          fastcgi_param PATH_INFO $fastcgi_path_info;
      }
    }
---
apiVersion: v1
kind: Service
metadata:
  name: webserver
  labels:
    tier: backend
spec:
  selector:
    app: webserver
    tier: backend
  ports:  
  - name: http
    port: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webserver
  labels:
    tier: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: webserver
      tier: backend
  template:
    metadata:
      labels:
        app: webserver
        tier: backend
    spec:
      securityContext:
        fsGroup: 65533 # to make SSH key readable
      volumes:
      - name: dir
        emptyDir: {}
      - name: git-secret
        secret:
          secretName: github-creds
          defaultMode: 288
      - name: config
        configMap:
          name: webserver-config
          items:
          - key: config
            path: default.conf
      containers:
      - env:
        - name: GIT_SYNC_REPO
          value: git@github.com:<some user>/mysamplerepo.git
        - name: GIT_SYNC_BRANCH
          value: master
        - name: GIT_SYNC_SSH
          value: "true"
        - name: GIT_SYNC_PERMISSIONS
          value: "0777"
        - name: GIT_SYNC_DEST
          value: www
        - name: GIT_SYNC_ROOT
          value: /git
        name: git-sync
        image: k8s.gcr.io/git-sync:v3.1.1
        securityContext:
          runAsUser: 65533 # git-sync user
        volumeMounts:
        - name: git-secret
          mountPath: /etc/git-secret
        - name: dir
          mountPath: /git
      - name: webserver
        image: nginx:latest
        ports:
        - containerPort: 80
        volumeMounts:
        - name: dir
          mountPath: /usr/share/nginx
        - name: config
          mountPath: /etc/nginx/conf.d
