apiVersion: apps/v1
kind: Deployment
metadata:
  name: pinnwand
  namespace: web
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pinnwand
  template:
    metadata:
      labels:
        app: pinnwand
    spec:
      initContainers:
        - name: init-service
          image: busybox:latest
          command: ["wget", "https://raw.githubusercontent.com/python-discord/branding/main/logos/logo_discord/logo_discord_256.png", "-O", "/tmp/logo.png"]
          volumeMounts:
            - name: pinnwand-logo
              mountPath: /tmp/
      containers:
        - name: pinnwand
          image: ghcr.io/python-discord/pinnwand:latest-psql
          command: ["venv/bin/python3", "-m", "pinnwand", "-vvvvvvvv", "--configuration-path", "/config/config.toml", "http"]
          imagePullPolicy: Always
          resources:
            requests:
              cpu: 5m
              memory: 100Mi
            limits:
              cpu: 100m
              memory: 200Mi
          ports:
            - containerPort: 8000
          envFrom:
          - secretRef:
              name: pinnwand-postgres-connection
          securityContext:
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: pinnwand-config
              mountPath: /config/
            - name: pinnwand-logo
              mountPath: /usr/app/pinnwand/static/logo.png
              subPath: logo.png
      volumes:
        - name: pinnwand-logo
          emptyDir: {}
        - name: pinnwand-config
          configMap:
            name: pinnwand-config
      securityContext:
        fsGroup: 2000
        runAsUser: 1000
        runAsNonRoot: true