feat(k8s/grocy): add grocy stack (deployment scaled to 0 for data migration)

kubernetes/app/grocy/deployment.yaml

@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grocy
+  namespace: grocy
+  labels:
+    app: grocy
+spec:
+  replicas: 0
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: grocy
+  template:
+    metadata:
+      labels:
+        app: grocy
+    spec:
+      securityContext:
+        # runAsNonRoot omitted — LinuxServer image requires root for s6-overlay init
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: migrate-db-to-local
+          image: busybox:1.36
+          command:
+            - sh
+            - -c
+            - |
+              if [ ! -d /config/data ]; then
+                echo "No /config/data yet — skipping"
+                exit 0
+              fi
+              cd /config/data
+              for db in *.db; do
+                [ -f "$db" ] && [ ! -L "$db" ] || continue
+                echo "Migrating $db to local storage..."
+                cp "$db" "/db-local/$db"
+                rm -f "$db"
+                ln -sf "/db-local/$db" "$db"
+              done
+              echo "Done"
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: db
+              mountPath: /db-local
+      containers:
+        - name: grocy
+          image: linuxserver/grocy:4.6.0
+          ports:
+            - containerPort: 80
+              name: http
+              protocol: TCP
+          env:
+            - name: PUID
+              value: "1027"
+            - name: PGID
+              value: "100"
+            - name: TZ
+              value: Etc/UTC
+            - name: UMASK
+              value: "002"
+            - name: GROCY_AUTH_CLASS
+              value: "Grocy\\Middleware\\ReverseProxyAuthMiddleware"
+            - name: GROCY_REVERSE_PROXY_AUTH_HEADER
+              value: Remote-User
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: db
+              mountPath: /db-local
+          livenessProbe:
+            tcpSocket:
+              port: 80
+            initialDelaySeconds: 90
+            periodSeconds: 30
+          readinessProbe:
+            tcpSocket:
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 512Mi
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: grocy-config
+        - name: db
+          persistentVolumeClaim:
+            claimName: grocy-db