apiVersion: apps/v1
kind: Deployment
metadata:
  name: prop
  namespace: prop
spec:
  replicas: 3
  minReadySeconds: 10
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app: prop
  template:
    metadata:
      labels:
        app: prop
    spec:
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: prop
              topologyKey: topology.kubernetes.io/physical-host
      serviceAccountName: prop
      imagePullSecrets:
        - name: forgejo-registry
      securityContext:
        runAsUser: 65534
        runAsNonRoot: true
        fsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: prop
          image: git.mcintire.me/graham/prop:main-1775578557-be70d39 # {"$imagepolicy": "flux-system:prop"}
          imagePullPolicy: IfNotPresent
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: PHX_SERVER
              value: "true"
            - name: PHX_HOST
              value: "prop.w5isp.com"
            - name: PORT
              value: "5000"
            - name: HRRR_BASE_URL
              value: "http://skippy.w5isp.com:8080"
          envFrom:
            - secretRef:
                name: prop-secrets
          ports:
            - name: http
              containerPort: 5000
              protocol: TCP
          startupProbe:
            httpGet:
              path: /health
              port: 5000
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 12
            timeoutSeconds: 3
          readinessProbe:
            httpGet:
              path: /health
              port: 5000
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 2
            timeoutSeconds: 2
          livenessProbe:
            httpGet:
              path: /health
              port: 5000
            periodSeconds: 10
            failureThreshold: 3
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 4Gi
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 65534
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: srtm-data
              mountPath: /srtm
              readOnly: true
      volumes:
        - name: srtm-data
          nfs:
            server: 204.110.191.8
            path: /data/srtm
            readOnly: true