apiVersion: apps/v1
kind: Deployment
metadata:
  name: vncmail-plus
  labels:
    app: vncmail-plus
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vncmail-plus
  # RWO volumes can only mount to one pod — Recreate avoids a stuck rollout.
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: vncmail-plus
    spec:
      # The image runs as uid/gid 1001 (nextjs:nodejs) and the Dockerfile
      # chowns /app/data to 1001. fsGroup makes the mounted PVCs writable by it.
      securityContext:
        fsGroup: 1001
        runAsUser: 1001
        runAsGroup: 1001
      # ghcr package is private by default — see deploy/k8s/README.md to create
      # this pull secret. Delete this block if you make the package public.
      # NOTE: once CI moves to pushing registry.gitlab.vnc.biz images (the
      # dev-auto-deploy phase of the GitLab pipeline), this needs to become a
      # docker-registry secret for that registry instead — comments only,
      # deliberately not renamed here, so this file stays a no-op today.
      imagePullSecrets:
        - name: ghcr-pull
      containers:
        - name: vncmail-plus
          # Default/legacy value — CI overrides the image per-deploy via
          # `kustomize edit set image`, so what's committed here never goes
          # stale. For a one-off manual apply, pin a digest instead of :latest.
          image: ghcr.io/brvncde-dotcom/vncmail-plus-dev:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 3000
          envFrom:
            - secretRef:
                name: vncmail-env
          env:
            - name: HOSTNAME
              value: "0.0.0.0"
            - name: PORT
              value: "3000"
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 25
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: settings
              mountPath: /app/data/settings
            - name: admin
              mountPath: /app/data/admin
            - name: admin-state
              mountPath: /app/data/admin-state
            - name: telemetry
              mountPath: /app/data/telemetry
      volumes:
        - name: settings
          persistentVolumeClaim:
            claimName: vncmail-settings
        - name: admin
          persistentVolumeClaim:
            claimName: vncmail-admin
        - name: admin-state
          persistentVolumeClaim:
            claimName: vncmail-admin-state
        - name: telemetry
          persistentVolumeClaim:
            claimName: vncmail-telemetry