apiVersion: v1
kind: Namespace
metadata:
  name: quic-proxy
---
apiVersion: v1
kind: Secret
metadata:
  name: quic-client-secret
  namespace: quic-proxy
type: Opaque
stringData:
  token: "5$5O4QjRh#eOaM"
  ca-cert-b64: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZVekNDQXp1Z0F3SUJBZ0lVTlhENnExcCtxY1NrMTlhM29hejVHWHVPWFpnd0RRWUpLb1pJaHZjTkFRRUwKQlFBd09URWFNQmdHQTFVRUF3d1JkbmN1YlhKc2IydHZjQzVrWlhZZ1EwRXhEakFNQmdOVkJBb01CVkJ5YjNoNQpNUXN3Q1FZRFZRUUdFd0pWVXpBZUZ3MHlOakF4TVRJeE16STVORFZhRncweU56QXhNVEl4TXpJNU5EVmFNRGt4CkdqQVlCZ05WQkFNTUVYWjNMbTF5Ykc5cmIzQXVaR1YySUVOQk1RNHdEQVlEVlFRS0RBVlFjbTk0ZVRFTE1Ba0cKQTFVRUJoTUNWVk13Z2dJaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQ0R3QXdnZ0lLQW9JQ0FRQzRmMzZsWG1MZQphbXhDc1RPN1RWTXV3a1YybFIzTUpCSFU2TGJOK1R1STZEZHBOVFc3OFBUNndTOFk5S09Ha2pzZGdEcDJ6MVg2CjNVQitiUFlZVTdIRVhqZ05PRzRGdmE2RWt5b0NXbW83azZsSTgwVmM5cUVCb2hZL3d6QWhoMVEveUZ5Vk1DdWEKMVlrekUvRTlVbnIycndoMUVWb3ZJUThkTENpL3I5NDJHcndpK240Zm5CUFhGakdTSUR1dkdPanBKYXo4YlQveApxeGhWV0RUaXR5WWU2NkRvKzNmaC9EbmtPck5RVEJXY0dyaTF2WW84b3pGMzBGVHR1S0RsOWJucEt6TVBiT2dxClJROFNZaGEyc0lJMkZsYUxsMW1mViszWjl1UWZJU2hUM1pZbEJMeGJsc0hLUVQ5WnhYUVY0QVdjV1IxVVVBYnkKblpBdjdWOFdid3pmL1ozRllKelFMYk9kUlZuREIwa3VyR2JKS0RhcHpJSTJJcVNCVTJ6YWhOTi9RTnpPZDZ5QgpmMGZOWWJqWklPOHd2Z3VBRXhUaGRPSVoyM1l0N05NbzU4SFpzTlJVaUtkQ3kyZUdZc2ZXMlhBKy9yZDlsMENLCjNob2IwbWtxY0tyYXMvZGlXekxoa2NNVFhOMG9WZHhTdld2aDB4SFFrUWRGaGdPalJ5OG5ocnRnM3dKbDJXa2kKY2VCVEp4UzdlTiswRU1EYXl0ZVZTZ0N6QW9lTEJmaitCSTdHMDRnWktPMmErVFlqUFFvUC9reXpaQ2d6eXF2YgpZZFZMajBjeFhzcTRtVllxaU5OWTdwRDh6Sjg3MmpFcVlhY2tDL2tpUnBKRFcwalJCVlRjcnpvejZBa1J5VFhYCjBZaXV2bVNTcm1UN0FqdkhneXk4SzlISytOZHo0VVBkbVFJREFRQUJvMU13VVRBZEJnTlZIUTRFRmdRVUpySmwKVWs1a0NxSjMzTGJTNTQ1VC9DUXY3S0V3SHdZRFZSMGpCQmd3Rm9BVUpySmxVazVrQ3FKMzNMYlM1NDVUL0NRdgo3S0V3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBcWdJenF2WHc3V3plCjVSck5GektnSEtQcGdIdjV0NWQ3V1V3Qy94U3pxUC9Ec0RxaHNMLzRhWmRBWnhrSWZXKzFwMTFDdFRCL1drQWoKZG0raDg0NTlObHJsaFdSaU45QThyQlZYejFLSitGazhTTWdtTEQyejllQldDWUNnL3RnV25qNU05UGU3d0x0UgpxQ3hHNkhSV3daOUZaVWJFb2FoWmF3UUU3eWJ6aGJTZUVJSlhaTDB3RnAweEtlckdhMXRmOG9GelhuNWVlWDlQCmlsSCthRVJuZ0dZYXl2YWM3dHZST25aNkQ3RjQzWkpJNXhiV3FCMTNQM3NZMGZ4R1RKd3RYZmlFQmZxcmU5QlAKNTE4UHRHWldQLzY1U0Z5U2NqK3k0SGRXbExPOXljSHVnQ0U3SXZxQ0FXSm84ZDFzOHFsODRmS2pYcU1Ib0NKVgpzaDBWampDSWh0OUJoZE9PbmFwVTh1MEV1TERFdWw0SWZTVnJCU1kwbHhZT0VReUFjbGQwd005Zy9LZlFONW5XCjBLaWdlZmlSdC9sR3NNM0hlSDNzeDExbGlQNFp6WUhSNjY0YzZNdjNOcTBKNk9xTjFVb1p0cnJOaEI1VVB0UGsKT2lNT1hub21NSEQzeTI4VVQ3OG5nRkpEaDBpMUNSbWRRb2VNelJJcm5yMGNJRmV6UmN3ekVhNWtQZFZUcDRXRApsdGVJTVNmNGxPRFlLb09BUXJzdDBqU2NoUXhKaFI0V1dzQlRLODEra3V1Y096Z1dSaExkMXNPODhidmF5OGdPCjg3NDFuZksyR2MrVUVjRmFpRXBtVTJ1Mi8wUFh4V3cvUCtaNEFwSkJqR1ZhM2RXQWcyd1RDYkhXR01LRWhzcjEKTFdNOUF6MGQwRW9zTngyY3ZHZ0paQnlkUE1nL1p5bz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: quic-client
  namespace: quic-proxy
  labels:
    app: quic-client
spec:
  selector:
    matchLabels:
      app: quic-client
  template:
    metadata:
      annotations:
        policy.nnstd.dev/allow-latest: "true"
      labels:
        app: quic-client
    spec:
# TODO: Enable sysctls if needed
#      securityContext:
#        sysctls:
#          - name: net.core.rmem_max
#            value: "7500000"
#          - name: net.core.wmem_max
#            value: "7500000"
      containers:
        - name: quic-client
          image: git.mrlokop.dev/images/quic-client:latest
          imagePullPolicy: Always
          env:
            - name: PROXY_SERVER
              value: "95.31.11.36:8443"
            - name: PROXY_TOKEN
              valueFrom:
                secretKeyRef:
                  name: quic-client-secret
                  key: token
            - name: PROXY_CA_CERT
              valueFrom:
                secretKeyRef:
                  name: quic-client-secret
                  key: ca-cert-b64
          resources:
            requests:
              memory: "100Mi"
              cpu: "50m" # 50 millicores (0.05 CPU)
            limits:
              memory: "256Mi"
              cpu: "200m" # 200 millicores (0.2 CPU)
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65534
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
      terminationGracePeriodSeconds: 30
      tolerations:
        - operator: Exists
          effect: NoSchedule
        - operator: Exists
          effect: NoExecute