# 1. Namespace — every other object lives in this namespace
apiVersion: v1
kind: Namespace
metadata:
  name: taskapp
  labels:
    app: taskapp

---
# 2. Secret — DB credentials, consumed by both Postgres and Flask
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: taskapp
type: Opaque
data:
  POSTGRES_DB:       dGFza2FwcA==
  POSTGRES_USER:     dGFza3VzZXI=
  POSTGRES_PASSWORD: dGFza3Bhc3M=

---
# 3. ConfigMap — nginx.conf for the web tier
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: taskapp
data:
  nginx.conf: |
    worker_processes  1;

    events {
        worker_connections  1024;
    }

    http {
        include       mime.types;
        default_type  application/octet-stream;
        sendfile      on;
        keepalive_timeout 65;

        large_client_header_buffers 4 32k;

        upstream api_backend {
            server api:5000;
        }

        server {
            listen       80;
            server_name  localhost;

            root /usr/share/nginx/html;
            index index.html;

            location / {
                try_files $uri $uri/ /index.html;
            }

            location /api/ {
                proxy_pass http://api_backend;
                proxy_http_version 1.1;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            }
        }
    }