# One-shot: ingest Deribit funding (BTC/ETH) + run the cross-venue-carry OOS walk-forward, in an own-memory Job
# (the daemon OOM'd on cumulative session load). NO PVC, git-sync, reads/writes TimescaleDB networked.
apiVersion: batch/v1
kind: Job
metadata:
  name: fxhnt-deribit-carry
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-deribit-carry, app.kubernetes.io/part-of: foxhunt }
spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 604800
  template:
    metadata:
      labels: { app.kubernetes.io/name: fxhnt-deribit-carry, app.kubernetes.io/part-of: foxhunt }
    spec:
      restartPolicy: Never
      imagePullSecrets:
        - name: scw-registry
      initContainers:
        - name: git-sync
          image: alpine/git:latest
          command: [/bin/sh, -c]
          args:
            - |
              mkdir -p /root/.ssh && cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
              printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
              rm -rf /code/src
              git clone --depth 1 --branch master --filter=blob:none --sparse \
                "ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /tmp/repo
              cd /tmp/repo && git sparse-checkout set src && [ -d /tmp/repo/src ]
              cp -a /tmp/repo/src /code/src && echo "git-sync OK: $(git rev-parse --short HEAD)"
          resources: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
          volumeMounts:
            - { name: code, mountPath: /code }
            - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
      containers:
        - name: carry
          image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
          command: ["sh", "-c", "fxhnt ingest-deribit-funding --instruments BTC_USDC-PERPETUAL,ETH_USDC-PERPETUAL,SOL_USDC-PERPETUAL,XRP_USDC-PERPETUAL,ADA_USDC-PERPETUAL,AVAX_USDC-PERPETUAL,BCH_USDC-PERPETUAL,BNB_USDC-PERPETUAL,DOGE_USDC-PERPETUAL,DOT_USDC-PERPETUAL,LINK_USDC-PERPETUAL,LTC_USDC-PERPETUAL,NEAR_USDC-PERPETUAL,TRX_USDC-PERPETUAL,UNI_USDC-PERPETUAL,ALGO_USDC-PERPETUAL,HYPE_USDC-PERPETUAL,TRUMP_USDC-PERPETUAL,PAXG_USDC-PERPETUAL && echo '=== WALK-FORWARD ===' && fxhnt cross-venue-carry-eval --walk-forward --all"]
          env:
            - { name: PYTHONPATH, value: /code/src }
            - { name: FXHNT_OPERATIONAL_DSN, value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt" }
            - name: PGPASSWORD
              valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
            - { name: PYTHONUNBUFFERED, value: "1" }
          resources:
            requests: { memory: "1Gi", cpu: "500m" }
            limits: { memory: "4Gi", cpu: "2" }
          volumeMounts:
            - { name: code, mountPath: /code, readOnly: true }
      volumes:
        - { name: code, emptyDir: {} }
        - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-deribit-carry
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector: { matchLabels: { app.kubernetes.io/name: fxhnt-deribit-carry } }
  policyTypes: [Egress]
  egress:
    - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: postgres } } }]
      ports: [{ port: 5432, protocol: TCP }]
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]
      ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
    - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 172.16.0.0/16] } }]   # Deribit API (443)
      ports: [{ port: 443, protocol: TCP }]
