apiVersion: apps/v1
kind: Deployment
metadata:
  name: vncmail-plus
  labels:
    app: vncmail-plus
spec:
  replicas: 1
  selector:
    matchLabels:
      app: vncmail-plus
  # RWO volumes can only mount to one pod — Recreate avoids a stuck rollout.
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: vncmail-plus
    spec:
      # The image runs as uid/gid 1001 (nextjs:nodejs) and the Dockerfile
      # chowns /app/data to 1001. fsGroup makes the mounted PVCs writable by it.
      securityContext:
        fsGroup: 1001
        runAsUser: 1001
        runAsGroup: 1001
      # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public
      # (anonymous token pull succeeded) — no imagePullSecrets needed. This is
      # deploy/k8s/README.md's own documented alternative to creating a
      # ghcr-pull secret. Removed rather than left referencing a
      # not-yet-created secret, which would otherwise block every pod from
      # starting regardless of the image being public (kubelet fails to
      # resolve a missing imagePullSecrets entry before it ever gets to
      # deciding whether auth was actually required).
      containers:
        - name: vncmail-plus
          # Default/legacy value — CI overrides the image per-deploy via
          # `kustomize edit set image`, so what's committed here never goes
          # stale. For a one-off manual apply, pin a digest instead of :latest.
          image: ghcr.io/brvncde-dotcom/vncmail-plus-dev:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 3000
          envFrom:
            - secretRef:
                name: vncmail-env
          env:
            - name: HOSTNAME
              value: "0.0.0.0"
            - name: PORT
              value: "3000"
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3000
            initialDelaySeconds: 25
            periodSeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: settings
              mountPath: /app/data/settings
            - name: admin
              mountPath: /app/data/admin
            - name: admin-state
              mountPath: /app/data/admin-state
            - name: telemetry
              mountPath: /app/data/telemetry
      volumes:
        - name: settings
          persistentVolumeClaim:
            claimName: vncmail-settings
        - name: admin
          persistentVolumeClaim:
            claimName: vncmail-admin
        - name: admin-state
          persistentVolumeClaim:
            claimName: vncmail-admin-state
        - name: telemetry
          persistentVolumeClaim:
            claimName: vncmail-telemetry