---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prowlarr
  namespace: arrstack
spec:
  # Active-active: the -unkin2 fork keeps all state in the shared Postgres
  # (arrstack-postgres) and coordinates via Postgres advisory locks, so N
  # replicas run concurrently behind the prowlarr Service. RollingUpdate is safe
  # — no SQLite, no RWO lock.
  replicas: 3
  strategy:
    type: RollingUpdate
  selector:
    matchLabels:
      app: prowlarr
  template:
    metadata:
      labels:
        app: prowlarr
    spec:
      securityContext:
        # Fork image has no USER (runs as root by default); pin it to a non-root
        # UID and group-write the shared RWX CephFS /config. OnRootMismatch
        # avoids a recursive chown of the whole volume.
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: prowlarr
          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/prowlarr:v2.6.2-unkin2
          imagePullPolicy: IfNotPresent
          command:
            - /app/Prowlarr
          args:
            - -nobrowser
            - -data=/config
            # Required: bypass the single-instance guard so multiple replicas
            # can share one /config. Cross-replica safety is the Postgres layer,
            # not a local lock file.
            - -nosingleinstancecheck
          ports:
            - name: http
              containerPort: 9696
              protocol: TCP
          envFrom:
            - configMapRef:
                name: prowlarr-env
          env:
            - name: Prowlarr__Postgres__User
              valueFrom:
                secretKeyRef:
                  name: prowlarr-db
                  key: username
            - name: Prowlarr__Postgres__Password
              valueFrom:
                secretKeyRef:
                  name: prowlarr-db
                  key: password
            - name: Prowlarr__Auth__ApiKey
              valueFrom:
                secretKeyRef:
                  name: prowlarr-apikey
                  key: apitoken
          livenessProbe:
            httpGet:
              path: /prowlarr/ping
              port: http
            initialDelaySeconds: 30
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /prowlarr/ping
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: config
              mountPath: /config
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: prowlarr-config