---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: watchstate
  namespace: watchstate
spec:
  replicas: 1
  selector:
    matchLabels:
      app: watchstate
  strategy:
    # sqlite + the in-container cron/redis single-writer; never run two pods.
    type: Recreate
  template:
    metadata:
      labels:
        app: watchstate
    spec:
      serviceAccountName: default
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: watchstate
          # Canonical upstream image; containerd mirrors route ghcr.io via
          # artifactapi (do NOT prefix with the artifactapi host).
          image: ghcr.io/arabcoders/watchstate:v1.10.3
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              name: http
              protocol: TCP
          env:
            - name: WS_UID
              value: "1000"
            - name: WS_GID
              value: "1000"
            - name: WS_TZ
              value: Australia/Sydney
          volumeMounts:
            - name: config
              mountPath: /config
          livenessProbe:
            httpGet:
              path: /v1/api/system/healthcheck
              port: http
            initialDelaySeconds: 20
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /v1/api/system/healthcheck
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: watchstate-config
      restartPolicy: Always