apiVersion: apps/v1
kind: Deployment
metadata:
  name: grocy
  namespace: grocy
  labels:
    app: grocy
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: grocy
  template:
    metadata:
      labels:
        app: grocy
    spec:
      securityContext:
        # runAsNonRoot omitted — LinuxServer image requires root for s6-overlay init
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: migrate-db-to-local
          image: busybox:1.36
          command:
            - sh
            - -c
            - |
              if [ ! -d /config/data ]; then
                echo "No /config/data yet — skipping"
                exit 0
              fi
              cd /config/data
              for db in *.db; do
                [ -f "$db" ] && [ ! -L "$db" ] || continue
                echo "Migrating $db to local storage..."
                cp "$db" "/db-local/$db"
                rm -f "$db"
                ln -sf "/db-local/$db" "$db"
              done
              echo "Done"
          volumeMounts:
            - name: config
              mountPath: /config
            - name: db
              mountPath: /db-local
      containers:
        - name: grocy
          image: linuxserver/grocy:4.6.0
          ports:
            - containerPort: 80
              name: http
              protocol: TCP
          env:
            - name: PUID
              value: "1027"
            - name: PGID
              value: "100"
            - name: TZ
              value: Etc/UTC
            - name: UMASK
              value: "002"
            - name: GROCY_AUTH_CLASS
              value: "Grocy\\Middleware\\ReverseProxyAuthMiddleware"
            - name: GROCY_REVERSE_PROXY_AUTH_HEADER
              value: Remote-User
          volumeMounts:
            - name: config
              mountPath: /config
            - name: db
              mountPath: /db-local
          livenessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 90
            periodSeconds: 30
          readinessProbe:
            tcpSocket:
              port: 80
            initialDelaySeconds: 30
            periodSeconds: 10
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 512Mi
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: grocy-config
        - name: db
          persistentVolumeClaim:
            claimName: grocy-db