---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mediamark
  namespace: mediamark
  annotations:
    secret.reloader.stakater.com/reload: "arrstack-virtual-key"
spec:
  replicas: 2
  selector:
    matchLabels:
      app: mediamark
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: mediamark
    spec:
      serviceAccountName: default
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        # 1000:1000 matches the media tree ownership on the shared mediastore
        # subvolume; mediamark hardlinks/renames files the *arr apps own, so it
        # deliberately does NOT run as the usual 65532.
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: mediamark
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            - name: MEDIAMARK_MEDIA_ROOT
              value: /media
            - name: MEDIAMARK_KEYS_DIR
              value: /etc/mediamark/keys
            # Virtual keys are only honoured by arrproxy, which validates the
            # machine token and injects the real per-app key upstream; the
            # sonarr/radarr Services would reject them.
            - name: MEDIAMARK_SONARR_URL
              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/sonarr
            - name: MEDIAMARK_RADARR_URL
              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/radarr
            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
            # auth_request-response-only and never reaches a proxied upstream.
            - name: MEDIAMARK_GROUPS_HEADER
              value: X-Forwarded-Groups
            - name: MEDIAMARK_ALLOWED_GROUPS
              value: akP-mediamark-user
          volumeMounts:
            - name: mediastore
              mountPath: /media
            - name: arr-keys
              mountPath: /etc/mediamark/keys
              readOnly: true
          livenessProbe:
            httpGet:
              path: /livez
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /readyz
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
      volumes:
        - name: mediastore
          persistentVolumeClaim:
            claimName: mediamark-mediastore
        # One ephemeral virtual key covers both apps, so the same token lands on
        # both per-app files under MEDIAMARK_KEYS_DIR; mediamark re-reads the
        # file per request, so lease renewal rotates in place.
        - name: arr-keys
          projected:
            sources:
              - secret:
                  name: arrstack-virtual-key
                  items:
                    - key: token
                      path: sonarr
                    - key: token
                      path: radarr
      restartPolicy: Always