apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "smart-updown-relayer.fullname" . }}
  labels:
    {{- include "smart-updown-relayer.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "smart-updown-relayer.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "smart-updown-relayer.selectorLabels" . | nindent 8 }}
    spec:
      # PVC (local-path) создаётся root-владельцем, а контейнер бежит под node (uid 1000).
      # fsGroup делает смонтированный volume записываемым для группы node — иначе
      # gateway падает с EACCES при записи keystore новых бетторов.
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      initContainers:
        - name: seed-bettors
          image: "{{ .Values.image.name }}:{{ default .Chart.AppVersion .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - sh
            - -c
            - '[ -f /app/data/.gateway-bettors.json ] || cp /seed/.gateway-bettors.json /app/data/.gateway-bettors.json; chmod 0644 /app/data/.gateway-bettors.json'
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: bettors-seed
              mountPath: /seed
              readOnly: true
      containers:
        - name: gateway
          image: "{{ .Values.image.name }}:{{ default .Chart.AppVersion .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            - name: http
              containerPort: {{ .Values.port }}
              protocol: TCP
          env:
            - name: SMART_RPC_URL
              value: {{ .Values.smart.rpcUrl | quote }}
            - name: SMART_PROGRAM_ID
              value: {{ .Values.smart.programId | quote }}
            - name: SMART_TOKEN_MINT
              value: {{ .Values.smart.tokenMint | quote }}
            - name: SMART_ADMIN_KEYPAIR
              value: {{ .Values.smart.adminKeypair | quote }}
            - name: SMART_MODE
              value: {{ .Values.smart.mode | quote }}
            - name: SMART_ALLOW_AIRDROP
              value: {{ .Values.smart.allowAirdrop | ternary "1" "0" | quote }}
            - name: SMART_MIN_AMOUNT
              value: {{ .Values.smart.minAmount | quote }}
            - name: SMART_MAX_AMOUNT
              value: {{ .Values.smart.maxAmount | quote }}
            - name: SMART_MULTIPLIER_BPS
              value: {{ .Values.smart.multiplierBps | quote }}
            - name: SMART_EXPIRY_SECONDS
              value: {{ .Values.smart.expirySeconds | quote }}
            - name: SMART_START_BALANCE
              value: {{ .Values.smart.startBalance | quote }}
            - name: GW_PORT
              value: {{ .Values.port | quote }}
            - name: GW_BETTOR_KEYSTORE
              value: {{ .Values.keystorePath | quote }}
            - name: NATS_URL
              value: {{ .Values.nats.url | quote }}
            - name: NATS_PRICE_SUBJECT
              value: {{ .Values.nats.priceSubject | quote }}
          livenessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 20
            periodSeconds: 15
          readinessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 20
            periodSeconds: 15
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: data
              mountPath: /app/data
            - name: admin-keypair
              mountPath: /app/secrets
              readOnly: true
      volumes:
        - name: data
          {{- if .Values.persistence.enabled }}
          persistentVolumeClaim:
            claimName: {{ include "smart-updown-relayer.fullname" . }}-data
          {{- else }}
          emptyDir: {}
          {{- end }}
        - name: admin-keypair
          secret:
            secretName: smart-updown-keypair
            items:
              - key: admin-keypair.json
                path: admin-keypair.json
            defaultMode: 0444
        - name: bettors-seed
          secret:
            secretName: testfront-bettors
            items:
              - key: .gateway-bettors.json
                path: .gateway-bettors.json
            defaultMode: 0444