---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nzbget-kids
  namespace: arrstack
spec:
  replicas: 1
  strategy:
    # RWO config PVC + single queue state: never run two pods at once.
    type: Recreate
  selector:
    matchLabels:
      app: nzbget-kids
  template:
    metadata:
      labels:
        app: nzbget-kids
    spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      initContainers:
        # Seed download layout onto the kids media subtrees (not /config or an
        # emptyDir) so completed kids downloads land beside the kids arr libraries
        # and imports are same-filesystem hardlink moves. The media mounts use the
        # tvshows/kids and movies/kids subPaths, so the in-container paths match
        # the adult nzbget while the data stays scoped to the kids subtree. Reuses
        # the image's own template and appends the path/category overrides once;
        # the grep guard keeps re-runs idempotent so admin UI edits survive.
        - name: seed-config
          image: docker.io/linuxserver/nzbget:version-v26.2
          command:
            - sh
            - -c
            - |
              set -e
              if [ ! -f /config/nzbget.conf ]; then
                cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
              fi
              if ! grep -q '# arrstack-managed' /config/nzbget.conf; then
                cat >> /config/nzbget.conf << 'CONF'

              # arrstack-managed download layout (appended once; last value wins).
              # Downloads land on the shared media PVCs by category so sonarr-kids/
              # radarr-kids import with atomic hardlink moves (download dir +
              # library share one filesystem per media type). InterDir is empty:
              # nzbget writes each download straight into its category DestDir, so
              # BOTH tv and movies stay on their own PVC with no cross-filesystem
              # intermediate copy.
              MainDir=/media/tv
              InterDir=
              DestDir=/media/tv/downloads
              NzbDir=/config/nzb
              QueueDir=/config/queue
              TempDir=/config/tmp
              ControlIP=0.0.0.0
              ControlPort=6789
              Category1.Name=tv
              Category1.DestDir=/media/tv/downloads
              Category2.Name=movies
              Category2.DestDir=/media/movies/downloads
              CONF
              fi
              mkdir -p /media/tv/series /media/tv/downloads /media/movies/films /media/movies/downloads
              chown 1000:1000 /config/nzbget.conf \
                /media/tv /media/tv/series /media/tv/downloads \
                /media/movies /media/movies/films /media/movies/downloads
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 200m
              memory: 128Mi
          volumeMounts:
            - name: config
              mountPath: /config
            - name: media-tv
              mountPath: /media/tv
              subPath: tvshows/kids
            - name: media-movies
              mountPath: /media/movies
              subPath: movies/kids
      containers:
        - name: nzbget
          image: docker.io/linuxserver/nzbget:version-v26.2
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 6789
              protocol: TCP
          env:
            - name: PUID
              value: "1000"
            - name: PGID
              value: "1000"
            - name: TZ
              value: Australia/Sydney
          livenessProbe:
            # nzbget's root path requires auth (401); a TCP check is the
            # dependency-free liveness signal for the web/JSON-RPC server.
            tcpSocket:
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              # Headroom for par2 repair + unpack of large downloads.
              cpu: "2"
              memory: 2Gi
          volumeMounts:
            - name: config
              mountPath: /config
            - name: media-tv
              mountPath: /media/tv
              subPath: tvshows/kids
            - name: media-movies
              mountPath: /media/movies
              subPath: movies/kids
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: nzbget-kids-config
        - name: media-tv
          persistentVolumeClaim:
            claimName: media-tv
        - name: media-movies
          persistentVolumeClaim:
            claimName: media-movies