apiVersion: apps/v1
kind: Deployment
metadata:
  name: prop-backfill
  namespace: prop
spec:
  # Start with 1. Scale up as additional prop-backfill=true nodes come online
  # (podAntiAffinity keys on physical-host, same as prop, so replicas stay
  # spread across distinct physical hosts).
  replicas: 1
  minReadySeconds: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app: prop
      tier: backfill
  template:
    metadata:
      labels:
        # app=prop matches the libcluster selector in runtime.exs, so these
        # pods join the same Erlang cluster as the hot-path prop pods and
        # share Oban's queue ownership / leader election.
        app: prop
        tier: backfill
    spec:
      nodeSelector:
        prop-backfill: "true"
      tolerations:
        # Matches the taint recommended for prop-backfill=true nodes. Remove
        # this block if you haven't tainted the nodes.
        - key: workload
          operator: Equal
          value: backfill
          effect: NoSchedule
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: prop
              topologyKey: topology.kubernetes.io/physical-host
      serviceAccountName: prop
      imagePullSecrets:
        - name: forgejo-registry
      securityContext:
        runAsUser: 65534
        runAsNonRoot: true
        fsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: prop-backfill
          image: git.mcintire.me/graham/prop:main-1776811628-04aa198 # {"$imagepolicy": "flux-system:prop"}
          imagePullPolicy: IfNotPresent
          env:
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            # No PHX_SERVER — endpoint stays inert. No PORT either.
            - name: PROP_ROLE
              value: "backfill"
            - name: PHX_HOST
              value: "prop.w5isp.com"
            - name: HRRR_BASE_URL
              value: "http://skippy.w5isp.com:8080"
              # OTLP disabled — see deployment.yaml for rationale.
          envFrom:
            - secretRef:
                name: prop-secrets
          # No HTTP probes (no web server). Use exec probe against the
          # running BEAM to confirm the VM is responsive.
          startupProbe:
            exec:
              command: ["/bin/sh", "-c", "/app/bin/microwaveprop rpc ':ok'"]
            initialDelaySeconds: 10
            periodSeconds: 5
            failureThreshold: 24
            timeoutSeconds: 5
          livenessProbe:
            exec:
              command: ["/bin/sh", "-c", "/app/bin/microwaveprop rpc ':ok'"]
            periodSeconds: 30
            failureThreshold: 3
            timeoutSeconds: 5
          resources:
            # 8GB T620 box — leave ~3GB for kubelet/containerd/OS.
            requests:
              cpu: 100m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 4Gi
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 65534
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: data
              mountPath: /data
      volumes:
        - name: data
          nfs:
            server: 10.0.15.103
            path: /data