# services/crypto/monerod/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: monerod
  namespace: crypto
  labels:
    app: monerod
    atlas.bstein.dev/workload-profile: heavy
spec:
  replicas: 1
  strategy: { type: Recreate }
  selector: { matchLabels: { app: monerod } }
  template:
    metadata:
      labels:
        app: monerod
        atlas.bstein.dev/workload-profile: heavy
    spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
      nodeSelector:
        node-role.kubernetes.io/worker: "true"
      imagePullSecrets:
        - name: harbor-regcred
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: hardware
                operator: In
                values: ["rpi4","rpi5"]
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 80
              preference:
                matchExpressions:
                - key: hardware
                  operator: In
                  values: ["rpi5"]
            - weight: 60
              preference:
                matchExpressions:
                - key: kubernetes.io/hostname
                  operator: NotIn
                  values: ["titan-12","titan-13","titan-15","titan-17","titan-19"]
      terminationGracePeriodSeconds: 120
      containers:
      - name: monerod
        image: registry.bstein.dev/crypto/monerod:0.18.4.1
        command: ["/opt/monero/monerod"]
        args:
          - --data-dir=/data
          - --non-interactive
          - --prune-blockchain
          - --rpc-bind-ip=0.0.0.0
          - --rpc-bind-port=18081
          - --confirm-external-bind
          - --rpc-ssl=disabled
          - --log-file=/tmp/monerod.log
          - --max-log-files=2
          - --p2p-bind-ip=0.0.0.0
          - --p2p-bind-port=18080
          - --no-igd
          - --zmq-pub=tcp://0.0.0.0:18083
          - --out-peers=8
          - --in-peers=16
          - --prep-blocks-threads=1
          - --max-concurrency=2
          - --block-sync-size=20
          - --add-priority-node=p2pmd.xmrvsbeast.com:18080
          - --add-priority-node=nodes.hashvault.pro:18080
          - --disable-dns-checkpoints
          - --enable-dns-blocklist
        ports:
          - { name: rpc,  containerPort: 18081 }
          - { name: p2p,  containerPort: 18080 }
          - { name: zmq,  containerPort: 18083 }
        # securityContext:
        #   allowPrivilegeEscalation: false
        #   readOnlyRootFilesystem: true
        #   runAsNonRoot: true
        #   runAsUser: 1000
        #   capabilities: { drop: ["ALL"] }
        readinessProbe:
          tcpSocket: { port: 18081 }
          initialDelaySeconds: 120
          periodSeconds: 10
          timeoutSeconds: 20
          failureThreshold: 18
        livenessProbe:
          tcpSocket: { port: 18081 }
          initialDelaySeconds: 300
          periodSeconds: 20
          timeoutSeconds: 20
          failureThreshold: 36
        resources:
          requests:
            cpu: 250m
            memory: 1Gi
          limits:
            cpu: 1500m
            memory: 3Gi
        lifecycle:
          preStop:
            exec:
              command: ["sh","-lc","kill -TERM 1; for i in $(seq 1 110); do kill -0 1 2>/dev/null || exit 0; sleep 1; done; exit 0"]
        volumeMounts:
        - { name: data, mountPath: /data }
        - { name: tmp,  mountPath: /tmp }
      - name: status-proxy
        image: python:3.11-alpine
        command: ["python", "/app/status_proxy.py"]
        ports:
          - { name: status, containerPort: 18084 }
        env:
          - name: MONEROD_LOG_FILE
            value: /tmp/monerod.log
          - name: MONEROD_STATUS_RPC_TIMEOUT_SEC
            value: "0.5"
        readinessProbe:
          httpGet:
            path: /healthz
            port: status
          initialDelaySeconds: 2
          periodSeconds: 10
          timeoutSeconds: 2
        livenessProbe:
          httpGet:
            path: /healthz
            port: status
          initialDelaySeconds: 10
          periodSeconds: 20
          timeoutSeconds: 2
        resources:
          requests:
            cpu: 10m
            memory: 32Mi
          limits:
            cpu: 100m
            memory: 128Mi
        volumeMounts:
        - { name: tmp, mountPath: /tmp }
        - { name: status-proxy, mountPath: /app/status_proxy.py, subPath: status_proxy.py }
      volumes:
      - name: data
        persistentVolumeClaim: { claimName: monerod-chain }
      - name: tmp
        emptyDir: {}
      - name: status-proxy
        configMap:
          name: monerod-status-proxy