# Pin SoulSync so an upstream `latest` update cannot change the running app
# without a reviewed Git commit.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: soulsync
  namespace: soulsync
spec:
  # not critical infra, a single pod should suffice
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: soulsync
  template:
    metadata:
      labels:
        app: soulsync
    spec:
      containers:
        - name: soulsync
          image: boulderbadgedad/soulsync:3.5.3
          imagePullPolicy: IfNotPresent
          env:
            - name: PUID
              value: "1000"
            - name: PGID
              value: "1000"
            - name: UMASK
              value: "022"
            - name: PYTHONPATH
              value: "/app"
            - name: SOULSYNC_CONFIG_PATH
              value: "/app/config/config.json"
            - name: TZ
              value: "Europe/London"
          ports:
            # HTTPS terminates at ingress-nginx, which forwards the UI and both
            # OAuth callback paths to SoulSync's main web server on this port.
            - name: http
              containerPort: 8008
              protocol: TCP
          # Kubernetes ignores the Docker image's HEALTHCHECK, so define probes
          # here to keep traffic away until SoulSync has actually started and to
          # restart it if its web server later stops responding.
          startupProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 24
          readinessProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /
              port: http
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          # Match the upstream Compose defaults: scheduling reserves enough for
          # normal operation while limits protect the rest of the cluster.
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 2Gi
          volumeMounts:
            - name: soulsync-db
              mountPath: /app/data
            - name: soulsync-config
              mountPath: /app/config
            - name: soulsync-logs
              mountPath: /app/logs
            - name: downloads
              mountPath: /app/downloads
            - name: music
              mountPath: /app/Transfer
            - name: podcasts
              mountPath: /app/podcasts
            - name: audiobooks
              mountPath: /app/audiobooks
            - name: movies
              mountPath: /media/movies
            - name: tvshows
              mountPath: /media/tv
      volumes:
        - name: soulsync-db
          persistentVolumeClaim:
            claimName: soulsync-db
        - name: soulsync-config
          persistentVolumeClaim:
            claimName: soulsync-config
        - name: soulsync-logs
          persistentVolumeClaim:
            claimName: soulsync-logs
        - name: downloads
          nfs:
            server: nas.ahmza.com
            path: /srv/media/torrents
        - name: music
          nfs:
            server: nas.ahmza.com
            path: /srv/media/Music
        - name: podcasts
          nfs:
            server: nas.ahmza.com
            path: /srv/media/Podcasts
        - name: audiobooks
          nfs:
            server: nas.ahmza.com
            path: /srv/media/Audiobooks
        - name: movies
          nfs:
            server: nas.ahmza.com
            path: /srv/media/Movies
        - name: tvshows
          nfs:
            server: nas.ahmza.com
            path: /srv/media/TVShows