apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-sync
spec:
  replicas: 1
  selector:
    matchLabels:
      app: immich-sync
  template:
    metadata:
      labels:
        app: immich-sync
    spec:
      automountServiceAccountToken: false
      containers:
      - name: immich-sync
        image: registry.brunner.ninja/feedc0de/immich-sync:latest
        imagePullPolicy: Always
        ports:
        - name: http
          containerPort: 8090
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 5
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 65532
          runAsGroup: 65532
        volumeMounts:
        - name: tmp
          mountPath: /tmp
      volumes:
      - name: tmp
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: immich-sync
spec:
  selector:
    app: immich-sync
  ports:
  - name: http
    port: 80
    targetPort: http