# Bybit rebalancer — DAILY CronJob running the crypto leg on BYBIT (testnet paper) via the
# BybitExecution adapter. Mirrors the fxhnt-CLI Job pattern (git-sync + fxhnt-cockpit image); runs
# `fxhnt execute-bybit --execute`, which computes the current Bybit-testnet target book, reconciles
# vs the Bybit account, and places orders through the ExecutionService safety gates. Paper/testnet
# base_url; live separately gated by allow_live.
#
# SHIP SUSPENDED (suspend: true): populate the `bybit-testnet-credentials` secret with testnet API
# keys, then `kubectl patch cronjob fxhnt-bybit-rebalancer -n foxhunt -p '{"spec":{"suspend":false}}'`
# to arm it (mirrors the Alpaca leg awaiting a key refresh).
apiVersion: batch/v1
kind: CronJob
metadata:
  name: fxhnt-bybit-rebalancer
  namespace: foxhunt
  labels: { app.kubernetes.io/name: fxhnt-bybit-rebalancer, app.kubernetes.io/part-of: foxhunt }
spec:
  schedule: "30 0 * * *"             # DAILY 00:30 UTC — crypto is 24/7 (matches the original bybit cadence); hysteresis prevents churn
  suspend: true                      # ARM only after bybit-testnet-credentials is populated
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 1
      ttlSecondsAfterFinished: 604800
      template:
        metadata:
          labels: { app.kubernetes.io/name: fxhnt-bybit-rebalancer, app.kubernetes.io/part-of: foxhunt }
        spec:
          restartPolicy: Never
          imagePullSecrets:
            - name: scw-registry
          initContainers:
            - name: git-sync
              image: alpine/git:latest
              command: [/bin/sh, -c]
              args:
                - |
                  mkdir -p /root/.ssh && cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519
                  printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
                  rm -rf /code/src
                  git clone --depth 1 --branch master --filter=blob:none --sparse \
                    "ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /tmp/repo
                  cd /tmp/repo && git sparse-checkout set src && [ -d /tmp/repo/src ]
                  cp -a /tmp/repo/src /code/src && echo "git-sync OK: $(git rev-parse --short HEAD)"
              resources: { requests: { cpu: 50m, memory: 64Mi }, limits: { cpu: 500m, memory: 256Mi } }
              volumeMounts:
                - { name: code, mountPath: /code }
                - { name: git-ssh-key, mountPath: /etc/git-ssh, readOnly: true }
          containers:
            - name: rebalancer
              image: rg.fr-par.scw.cloud/bizworx/fxhnt-cockpit:latest
              command: ["fxhnt", "execute-bybit", "--execute", "--paper-envelope", "1000000"]
              env:
                - { name: PYTHONPATH, value: /code/src }
                - { name: FXHNT_OPERATIONAL_DSN, value: "postgresql+psycopg://foxhunt@postgres.foxhunt.svc.cluster.local:5432/fxhnt" }
                - name: PGPASSWORD
                  valueFrom: { secretKeyRef: { name: db-credentials, key: password } }
                - name: FXHNT_BYBIT_EXEC_API_KEY
                  valueFrom: { secretKeyRef: { name: bybit-testnet-credentials, key: api-key } }
                - name: FXHNT_BYBIT_EXEC_API_SECRET
                  valueFrom: { secretKeyRef: { name: bybit-testnet-credentials, key: api-secret } }
                # testnet is the BybitExecution default (set_sandbox_mode(testnet=true)); live separately gated by allow_live.
                - { name: PYTHONUNBUFFERED, value: "1" }
              resources:
                requests: { memory: "512Mi", cpu: "250m" }
                limits: { memory: "1Gi", cpu: "1" }
              volumeMounts:
                - { name: code, mountPath: /code, readOnly: true }
          volumes:
            - { name: code, emptyDir: {} }
            - { name: git-ssh-key, secret: { secretName: argo-git-ssh-key, defaultMode: 256 } }
---
# Egress: DNS + Postgres (5432, write execution/fills) + gitea-sshd (22, git-sync) + external 443
# (Bybit is an EXTERNAL host — testnet REST/WS API — no in-cluster gateway pod selector needed).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-bybit-rebalancer
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector: { matchLabels: { app.kubernetes.io/name: fxhnt-bybit-rebalancer } }
  policyTypes: [Egress]
  egress:
    - ports: [{ port: 53, protocol: UDP }, { port: 53, protocol: TCP }]
    - to: [{ podSelector: { matchLabels: { app.kubernetes.io/name: postgres } } }]
      ports: [{ port: 5432, protocol: TCP }]
    - to: [{ namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: gitea } }, podSelector: { matchLabels: { app.kubernetes.io/name: gitea } } }]
      ports: [{ port: 2222, protocol: TCP }, { port: 22, protocol: TCP }]
    - to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] } }]   # api-testnet.bybit.com
      ports: [{ port: 443, protocol: TCP }]
