---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: immich-microservices
spec:
  replicas: 1
  selector:
    matchLabels:
      app: immich-microservices
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: immich-microservices
        component: microservices
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: init-dirs
          image: "ghcr.io/immich-app/immich-server:v3.3.5"
          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
          volumeMounts:
            - mountPath: /usr/src/app/upload
              name: immich-storage
      containers:
        - image: "ghcr.io/immich-app/immich-server:v3.3.5"
          name: immich-microservices
          env:
            - name: REDIS_HOSTNAME
              value: "{{ .redis.host }}"
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
                  key: redis.password
            - name: DB_HOSTNAME
              value: "{{ .db.host }}"
            - name: DB_USERNAME
              value: "{{ .db.user }}"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
                  key: dbPassword
            - name: TZ
              value: "UTC"
            - name: IMMICH_WORKERS_EXCLUDE
              value: api
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
            readOnlyRootFilesystem: false
          volumeMounts:
            - mountPath: /usr/src/app/upload
              name: immich-storage
              readOnly: false
      volumes:
        - name: immich-storage
          persistentVolumeClaim:
            claimName: immich-pvc
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app: immich
                component: server
            topologyKey: kubernetes.io/hostname