# services/mailu/mailbox-watchdog.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mailu-mailbox-watchdog
  namespace: mailu-mailserver
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mailu-mailbox-watchdog
  namespace: mailu-mailserver
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "delete"]
  - apiGroups: [""]
    resources: ["pods/exec"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mailu-mailbox-watchdog
  namespace: mailu-mailserver
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mailu-mailbox-watchdog
subjects:
  - kind: ServiceAccount
    name: mailu-mailbox-watchdog
    namespace: mailu-mailserver
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mailu-mailbox-watchdog
  namespace: mailu-mailserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mailu-mailbox-watchdog
  template:
    metadata:
      labels:
        app: mailu-mailbox-watchdog
    spec:
      serviceAccountName: mailu-mailbox-watchdog
      automountServiceAccountToken: true
      nodeSelector:
        hardware: rpi5
        node-role.kubernetes.io/worker: "true"
      containers:
        - name: watchdog
          image: registry.bstein.dev/bstein/kubectl:1.35.0
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-ec"]
          env:
            - name: HOME
              value: /tmp
          args:
            - |
              failures=0
              last_pod=""
              sleep 60
              while true; do
                pod="$(kubectl get pods \
                  -l app.kubernetes.io/component=dovecot,app.kubernetes.io/instance=mailu \
                  --field-selector=status.phase=Running \
                  -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"

                if [ -z "${pod}" ]; then
                  failures=0
                  last_pod=""
                  sleep 30
                  continue
                fi

                if [ "${pod}" != "${last_pod}" ]; then
                  failures=0
                  last_pod="${pod}"
                  echo "watching ${pod}; allowing startup grace"
                  sleep 60
                  continue
                fi

                if timeout 15s kubectl exec "${pod}" -c dovecot -- \
                  doveadm mailbox status -u brad@bstein.dev uidnext INBOX >/dev/null 2>&1; then
                  if [ "${failures}" -gt 0 ]; then
                    echo "mailbox health recovered after ${failures} failed checks"
                  fi
                  failures=0
                else
                  failures=$((failures + 1))
                  echo "mailbox health check failed (${failures}/4) for ${pod}" >&2
                fi

                if [ "${failures}" -ge 4 ]; then
                  echo "recreating ${pod} to remount mailbox storage after persistent failures" >&2
                  kubectl delete pod "${pod}" --wait=false
                  failures=0
                  last_pod=""
                  sleep 180
                  continue
                fi

                sleep 30
              done
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65532
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      imagePullSecrets:
        - name: harbor-regcred
      volumes:
        - name: tmp
          emptyDir: {}