apiVersion: apps/v1
kind: Deployment
metadata:
  name: adguard
  namespace: dns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: adguard
  strategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: adguard
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: copy-base-config
          image: busybox
          command: [ "cp", "/tmp/AdGuardHome.yaml", "/opt/adguardhome/conf/AdGuardHome.yaml" ]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ "ALL" ]
          volumeMounts:
            - name: config
              mountPath: /tmp/AdGuardHome.yaml
              subPath: AdGuardHome.yaml
            - name: config-folder
              mountPath: /opt/adguardhome/conf
        - name: append-users
          image: busybox
          command: [ "sh", "-c", "cat /tmp/users.yaml >> /opt/adguardhome/conf/AdGuardHome.yaml" ]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: [ "ALL" ]
          volumeMounts:
            - name: users
              mountPath: /tmp/users.yaml
              subPath: users.yaml
            - name: config-folder
              mountPath: /opt/adguardhome/conf
      containers:
        - name: adguard
          image: docker.io/adguard/adguardhome:v0.107.68 # renovate: docker=docker.io/adguard/adguardhome
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          # capabilities:
          #   drop: [ "ALL" ]
          ports:
            - name: dns-tcp
              containerPort: 53
              protocol: TCP
            - name: dns-udp
              containerPort: 53
              protocol: UDP
            - name: dchp
              containerPort: 67
              protocol: UDP
            - name: http
              containerPort: 3000
              protocol: TCP
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          volumeMounts:
            - name: config-folder
              mountPath: /opt/adguardhome/conf
            - name: work-folder
              mountPath: /opt/adguardhome/work
      volumes:
        - name: config
          configMap:
            name: adguard-config
        - name: users
          secret:
            secretName: users
        - name: config-folder
          emptyDir: { }
        - name: work-folder
          emptyDir: { }