---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: immich-server
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: immich-server
        component: server
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: init-dirs
          image: "ghcr.io/immich-app/immich-server:v3.3.5"
          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
          volumeMounts:
            - mountPath: /usr/src/app/upload
              name: immich-storage
      containers:
        - image: "ghcr.io/immich-app/immich-server:v3.3.5"
          name: immich-server
          ports:
            - containerPort: 2283
              protocol: TCP
          env:
            - name: REDIS_HOSTNAME
              value: "{{ .redis.host }}"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
                  key: redis.password
            - name: DB_HOSTNAME
              value: "{{ .db.host }}"
            - name: DB_USERNAME
              value: "{{ .db.user }}"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
                  key: dbPassword
            - name: TZ
              value: "UTC"
            - name: IMMICH_WORKERS_EXCLUDE
              value: microservices
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
          volumeMounts:
            - mountPath: /usr/src/app/upload
              name: immich-storage
              readOnly: false
      volumes:
        - name: immich-storage
          persistentVolumeClaim:
            claimName: immich-pvc