apiVersion: apps/v1
kind: Deployment
metadata:
  name: sparkyfitness-server
  labels:
    app.kubernetes.io/name: sparkyfitness
    app.kubernetes.io/instance: sparkyfitness
    app.kubernetes.io/managed-by: Helm
    helm.sh/chart: sparkyfitness-0.16.5-7
    app.kubernetes.io/component: server
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: sparkyfitness
      app.kubernetes.io/instance: sparkyfitness
      app.kubernetes.io/component: server
  template:
    metadata:
      annotations:
        checksum/config: 73103b48da701b599a76f155a028f2a486a63c4e61a49e8aa0af4db0abeb0162
      labels:
        app.kubernetes.io/name: sparkyfitness
        app.kubernetes.io/instance: sparkyfitness
        app.kubernetes.io/component: server
    spec:
      serviceAccountName: sparkyfitness-server
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: server
          image: ghcr.io/codewithcj/sparkyfitness-server:v0.16.6.2@sha256:c9fa57d68dc4bc5fae14075dc59ec2aea67d72710dd6ed289824960d4ecd22ad
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 3010
              protocol: TCP
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
          readinessProbe:
            httpGet:
              path: /api/health
              port: http
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 10
          envFrom:
            - configMapRef:
                name: sparkyfitness-server-config
          env:
            - name: SPARKY_FITNESS_API_ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-key-secret
                  key: api_encryption_key
            - name: BETTER_AUTH_SECRET
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-key-secret
                  key: better_auth_secret
            - name: SPARKY_FITNESS_APP_DB_USER
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-postgresql-18-cluster-app
                  key: username
            - name: SPARKY_FITNESS_APP_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-postgresql-18-cluster-app
                  key: password
            - name: SPARKY_FITNESS_DB_USER
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-postgresql-18-cluster-superuser
                  key: username
            - name: SPARKY_FITNESS_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-postgresql-18-cluster-superuser
                  key: password
            - name: SPARKY_FITNESS_OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-oidc-authentik
                  key: client_id
            - name: SPARKY_FITNESS_OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: sparkyfitness-oidc-authentik
                  key: client_secret
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsGroup: 1000
            runAsUser: 1000
          resources:
            limits: {}
            requests:
              cpu: 100m
              memory: 200Mi
          volumeMounts:
            - name: backup
              mountPath: /app/SparkyFitnessServer/backup
            - name: uploads
              mountPath: /app/SparkyFitnessServer/uploads
            - name: temp-uploads
              mountPath: /app/SparkyFitnessServer/temp_uploads
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: backup
          persistentVolumeClaim:
            claimName: sparkyfitness-server-backup
        - name: uploads
          persistentVolumeClaim:
            claimName: sparkyfitness-server-uploads
        - name: temp-uploads
          emptyDir: {}
        - name: tmp
          emptyDir: {}
