apiVersion: apps/v1
kind: Deployment
metadata:
  name: jarca-ledger
  labels:
    app.kubernetes.io/name: jarca-ledger
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: jarca-ledger
  template:
    metadata:
      labels:
        app.kubernetes.io/name: jarca-ledger
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      terminationGracePeriodSeconds: 30
      imagePullSecrets:
        - name: jarca-ledger-registry
      nodeSelector:
        kubernetes.io/os: linux
        kubernetes.io/arch: arm64
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: init-db
          image: gitea.jsfamily.quest/jsfamily/jarca-ledger-mcp:v0.1.2
          imagePullPolicy: IfNotPresent
          command:
            - python
            - -c
            - >-
              from jarca_ledger_mcp.service import health_check;
              result = health_check();
              assert result["success"], result
          env:
            - name: JARCA_LEDGER_DB_PATH
              value: /data/ledger.sqlite3
            - name: HOME
              value: /tmp
            - name: TMPDIR
              value: /tmp
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: data
              mountPath: /data
            - name: init-tmp
              mountPath: /tmp
      containers:
        - name: mcp
          image: gitea.jsfamily.quest/jsfamily/jarca-ledger-mcp:v0.1.2
          imagePullPolicy: IfNotPresent
          env:
            - name: JARCA_LEDGER_DB_PATH
              value: /data/ledger.sqlite3
            - name: HOME
              value: /tmp
            - name: TMPDIR
              value: /tmp
          ports:
            - name: mcp
              containerPort: 8000
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          startupProbe:
            tcpSocket:
              port: mcp
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 24
          readinessProbe:
            tcpSocket:
              port: mcp
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          livenessProbe:
            tcpSocket:
              port: mcp
            periodSeconds: 20
            timeoutSeconds: 2
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /data
            - name: mcp-tmp
              mountPath: /tmp
        - name: dashboard
          image: gitea.jsfamily.quest/jsfamily/jarca-ledger-mcp:v0.1.2
          imagePullPolicy: IfNotPresent
          command:
            - uvicorn
            - dashboard.server:app
            - --host
            - 0.0.0.0
            - --port
            - "8501"
            - --proxy-headers
          env:
            - name: JARCA_LEDGER_DB_PATH
              value: /data/ledger.sqlite3
            - name: HOME
              value: /tmp
            - name: TMPDIR
              value: /tmp
            - name: JARCA_DASHBOARD_ADMIN_ID
              valueFrom:
                secretKeyRef:
                  name: jarca-ledger-dashboard-auth
                  key: admin-id
            - name: JARCA_DASHBOARD_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: jarca-ledger-dashboard-auth
                  key: admin-password
            - name: JARCA_DASHBOARD_SIGNING_SECRET
              valueFrom:
                secretKeyRef:
                  name: jarca-ledger-dashboard-auth
                  key: signing-secret
            - name: FORWARDED_ALLOW_IPS
              value: 127.0.0.1
          ports:
            - name: dashboard
              containerPort: 8501
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          startupProbe:
            httpGet:
              path: /_stcore/health
              port: dashboard
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 24
          readinessProbe:
            httpGet:
              path: /_stcore/health
              port: dashboard
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /_stcore/health
              port: dashboard
            periodSeconds: 20
            timeoutSeconds: 2
            failureThreshold: 3
          volumeMounts:
            - name: data
              mountPath: /data
            - name: dashboard-tmp
              mountPath: /tmp
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: jarca-ledger-data
        - name: init-tmp
          emptyDir: {}
        - name: mcp-tmp
          emptyDir: {}
        - name: dashboard-tmp
          emptyDir: {}