---
apiVersion: v1
kind: Service
metadata:
  name: aprs-headless
  namespace: aprs
spec:
  clusterIP: None
  selector:
    app: aprs
  ports:
    - name: epmd
      port: 4369
      targetPort: 4369
---
apiVersion: v1
kind: Service
metadata:
  name: aprs
  namespace: aprs
spec:
  type: ClusterIP
  selector:
    app: aprs
  ports:
    - name: http
      port: 80
      targetPort: 4000
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: aprs
  namespace: aprs
spec:
  serviceName: aprs-headless
  replicas: 2
  selector:
    matchLabels:
      app: aprs
  template:
    metadata:
      labels:
        app: aprs
    spec:
      serviceAccountName: aprs
      imagePullSecrets:
      - name: ghcr-secret
      initContainers:
      - name: migrate
        image: ghcr.io/aprsme/aprs.me:latest
        command: ["/app/bin/migrate"]
        envFrom:
        - configMapRef:
            name: aprs-config
        - secretRef:
            name: aprs-secret
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 1000
          runAsGroup: 1000
          capabilities:
            drop:
              - ALL
          seccompProfile:
            type: RuntimeDefault
      containers:
      - name: aprs
        image: ghcr.io/aprsme/aprs.me:latest
        ports:
        - containerPort: 4000
          name: http
        - containerPort: 4369
          name: epmd
        envFrom:
        - configMapRef:
            name: aprs-config
        - secretRef:
            name: aprs-secret
        env:
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: RELEASE_NAME
          value: "aprsme@$(POD_NAME).aprs-headless.aprs.svc.cluster.local"
        livenessProbe:
          httpGet:
            path: /
            port: 4000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 4000
          initialDelaySeconds: 10
          periodSeconds: 5
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "1Gi"
            cpu: "500m"
        volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
        - name: app-volume
          mountPath: /app/tmp
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
          seccompProfile:
            type: RuntimeDefault
      volumes:
      - name: tmp-volume
        emptyDir: {}
      - name: app-volume
        emptyDir: {}