apiVersion: apps/v1
kind: Deployment
metadata:
  name: ghost-blog
  namespace: ghost-blog
  labels:
    app: ghost-blog
    app.kubernetes.io/name: ghost-blog
    app.kubernetes.io/instance: ghost-blog
    app.kubernetes.io/version: '5.92'
    app.kubernetes.io/component: ghost
    app.kubernetes.io/part-of: ghost-blog
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ghost-blog
  minReadySeconds: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 3
  revisionHistoryLimit: 4
  progressDeadlineSeconds: 600
  template:
    metadata:
      namespace: ghost-blog
      labels:
        app: ghost-blog
    spec:
      automountServiceAccountToken: false
      volumes:
      - name: ghost-content
        persistentVolumeClaim:
          claimName: ghost-content
      - name: tmp
        emptyDir:
          sizeLimit: 64Mi

      initContainers:
      - name: permissions-fix
        imagePullPolicy: IfNotPresent
        image: docker.io/busybox:stable-musl
        env:
        - name: GHOST_CONTENT
          value: /var/lib/ghost/content
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
        resources:
          limits:
            cpu: 500m
            memory: 256Mi
          requests:
            cpu: 100m
            memory: 128Mi
        command:
          - /bin/sh
          - '-c'
          - |
            set -e
            export DIRS='files logs apps themes data public settings images media'
            echo 'Check if base dirs exists, if not, create them'
            echo "Directories to check: $DIRS"
            for dir in $DIRS; do
              if [ ! -d $GHOST_CONTENT/$dir ]; then
                echo "Creating $GHOST_CONTENT/$dir directory"
                mkdir -pv $GHOST_CONTENT/$dir || echo "Error creating $GHOST_CONTENT/$dir directory"
              fi
              chown -Rfv 1000:1000 $GHOST_CONTENT/$dir && echo "chown ok on $dir" || echo "Error changing ownership of $GHOST_CONTENT/$dir directory"
            done
            exit 0
        volumeMounts:
        - name: ghost-content
          mountPath: /var/lib/ghost/content
          readOnly: false

      containers:
      - name: ghost-blog
        image: ghost:5.114.1-alpine
        imagePullPolicy: Always
        ports:
        - name: ghost
          containerPort: 2368
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /ghost/api/v4/admin/site/
            port: ghost
            httpHeaders:
            - name: X-Forwarded-Proto
              value: https
            - name: Host
              value: blog.rubenhensen.nl
          periodSeconds: 10
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 3
          initialDelaySeconds: 10
        livenessProbe:
          httpGet:
            path: /ghost/api/v4/admin/site/
            port: ghost
            httpHeaders:
            - name: X-Forwarded-Proto
              value: https
            - name: Host
              value: blog.rubenhensen.nl
          periodSeconds: 300
          timeoutSeconds: 3
          successThreshold: 1
          failureThreshold: 1
          initialDelaySeconds: 30
        env:
        - name: NODE_ENV
          value: production
        - name: database__client
          value: mysql
        - name: database__connection__host
          value: ghost-mysql-service
        - name: database__connection__user
          valueFrom:
            secretKeyRef:
              name: ghost-mysql-env
              key: MYSQL_USER
        - name: database__connection__password
          valueFrom:
            secretKeyRef:
              name: ghost-mysql-env
              key: MYSQL_PASSWORD
        - name: database__connection__database
          valueFrom:
            secretKeyRef:
              name: ghost-mysql-env
              key: MYSQL_DATABASE
        - name: url
          value: https://blog.rubenhensen.nl
        envFrom:
        - secretRef:
            name: ghost-mail-config
        resources:
          limits:
            cpu: 800m
            memory: 800Mi
          requests:
            cpu: 200m
            memory: 400Mi
        volumeMounts:
        - name: ghost-content
          mountPath: /var/lib/ghost/content
          readOnly: false
        - name: tmp
          mountPath: /tmp
          readOnly: false
        securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          runAsUser: 1000
      restartPolicy: Always
      terminationGracePeriodSeconds: 15
      dnsPolicy: ClusterFirst
      securityContext:
        seccompProfile:
          type: RuntimeDefault