apiVersion: apps/v1
kind: Deployment
metadata:
  name: obsidian-vault
  labels:
    app.kubernetes.io/name: obsidian-vault
  annotations:
    argocd.argoproj.io/sync-wave: "8"
spec:
  replicas: 1                # exactly one sync "device" per vault copy
  strategy:
    type: Recreate           # never two sync clients on the same folder
  selector:
    matchLabels:
      app.kubernetes.io/name: obsidian-vault
  template:
    metadata:
      labels:
        app.kubernetes.io/name: obsidian-vault
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10000
        runAsGroup: 10000
        fsGroup: 10000
        fsGroupChangePolicy: OnRootMismatch
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: ob
          image: ghcr.io/CHANGE_ME/obsidian-headless:0.0.13   # build from ./image
          env:
            - name: SYNC_MODE          # mirror-remote = download only, revert local changes
              value: mirror-remote
            - name: DEBUG              # "1" = idle instead of syncing, then kubectl exec in
              value: "0"
            - name: VAULT_PATH
              value: /vault
            - name: DEVICE_NAME        # shows up in Obsidian's sync version history
              value: k8s-obsidian
            - name: EXCLUDED_FOLDERS   # comma-separated folders that must never reach the cluster
              value: ""
            - name: HOME
              value: /state
            - name: XDG_CONFIG_HOME
              value: /state/config
            - name: VAULT_NAME
              valueFrom:
                secretKeyRef:
                  name: obsidian-vault
                  key: vault_name
            - name: E2EE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: obsidian-vault
                  key: e2ee_password
                  optional: true
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 512Mi
          volumeMounts:
            - name: vault
              mountPath: /vault
            - name: state
              mountPath: /state
            - name: auth
              mountPath: /secrets
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: vault
          persistentVolumeClaim:
            claimName: obsidian-vault
        - name: state
          persistentVolumeClaim:
            claimName: obsidian-sync-state
        - name: auth
          secret:
            secretName: obsidian-sync
            items:
              - key: auth_token
                path: auth_token
        - name: tmp
          emptyDir: {}