apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "immich-sync.fullname" . }}
  labels:
    {{- include "immich-sync.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  selector:
    matchLabels:
      {{- include "immich-sync.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "immich-sync.selectorLabels" . | nindent 8 }}
        {{- include "immich-sync.labels" . | nindent 8 }}
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 65532
        fsGroupChangePolicy: OnRootMismatch
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: immich-sync
        image: {{ printf "%s:%s" .Values.image.repository (default .Chart.AppVersion .Values.image.tag) | quote }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        env:
        - name: PORT
          value: "8090"
        - name: STATS_FILE
          value: /data/stats.json
        ports:
        - name: http
          containerPort: 8090
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 1
          periodSeconds: 5
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 5
          periodSeconds: 15
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65532
          runAsGroup: 65532
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: stats
          mountPath: /data
      volumes:
      - name: tmp
        emptyDir:
          sizeLimit: 20Gi
      - name: stats
        {{- if .Values.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ default (printf "%s-stats" (include "immich-sync.fullname" .)) .Values.persistence.existingClaim }}
        {{- else }}
        emptyDir: {}
        {{- end }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ include "immich-sync.fullname" . }}
  labels:
    {{- include "immich-sync.labels" . | nindent 4 }}
spec:
  ports:
  - name: http
    port: {{ .Values.service.port }}
    targetPort: http
  selector:
    {{- include "immich-sync.selectorLabels" . | nindent 4 }}