apiVersion: apps/v1
kind: Deployment
metadata:
  name: grist
  namespace: grist
  labels:
    app: grist
    component: app
spec:
  replicas: 0
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: grist
      component: app
  template:
    metadata:
      labels:
        app: grist
        component: app
    spec:
      initContainers:
      - name: wait-for-postgres
        image: postgres:16-alpine
        command:
        - sh
        - -c
        - |
          until pg_isready -h grist-postgres -U grist; do
            echo "Waiting for PostgreSQL..."
            sleep 2
          done
      securityContext:
        fsGroup: 1000
      containers:
      - name: grist
        image: gristlabs/grist:1.7.19
        ports:
        - name: http
          containerPort: 8484
        env:
        - name: APP_HOME_URL
          value: https://grist.basicstack.de
        - name: GRIST_DOMAIN
          value: grist.basicstack.de
        - name: GRIST_SINGLE_ORG
          value: docs
        - name: GRIST_ORG_IN_PATH
          value: "false"
        - name: GRIST_DEFAULT_PRODUCT
          value: Free
        - name: GRIST_HIDE_UI_ELEMENTS
          value: billing
        - name: PORT
          value: "8484"
        - name: TYPEORM_TYPE
          value: postgres
        - name: TYPEORM_HOST
          value: grist-postgres
        - name: TYPEORM_PORT
          value: "5432"
        - name: TYPEORM_DATABASE
          value: grist
        - name: TYPEORM_USERNAME
          value: grist
        - name: TYPEORM_PASSWORD
          valueFrom:
            secretKeyRef:
              name: grist-db-credentials
              key: postgres-password
        - name: GRIST_SESSION_SECRET
          valueFrom:
            secretKeyRef:
              name: grist-app-secrets
              key: session-secret
        - name: GRIST_OIDC_IDP_ISSUER
          value: https://auth.basicstack.de
        - name: GRIST_OIDC_IDP_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: grist-oidc-secret
              key: client-id
        - name: GRIST_OIDC_IDP_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: grist-oidc-secret
              key: client-secret
        - name: GRIST_OIDC_SP_HOST
          value: https://grist.basicstack.de
        - name: GRIST_OIDC_IDP_SCOPES
          value: openid email profile
        - name: GRIST_OIDC_IDP_END_SESSION_ENDPOINT
          value: https://auth.basicstack.de/api/oidc/end-session
        - name: GRIST_OIDC_SP_IGNORE_EMAIL_VERIFIED
          value: "true"
        - name: GRIST_DEFAULT_EMAIL
          value: andreas.leinen@basicstack.de
        - name: GRIST_FORCE_LOGIN
          value: "true"
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: "1"
            memory: 2Gi
        livenessProbe:
          tcpSocket:
            port: 8484
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /status
            port: 8484
          initialDelaySeconds: 30
          periodSeconds: 5
          timeoutSeconds: 3
        volumeMounts:
        - name: data
          mountPath: /persist
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: grist-data